CVE-2026-17524

HighCVSS 7.5/10Last modified Jul 30, 2026

Description

Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the extraction process. An attacker can bypass security checks designed to prevent directory traversal. The intended security function, isOutsideTargetFolder, only checks and caches the path status when the initial directory symlink is created during the first extraction.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Jul 28, 2026
Last modified: Jul 30, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-175255.2Incomplete cleanup vulnerability in ABB My Control System. This issue affects My Control System: 26.4 and 26.5.CVE-2026-175267.2Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role CVE-2026-175277.7In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI resources CVE-2026-175286.1Versions of the package nice-select2 before 2.4.1 are vulnerable to Cross-site Scripting (XSS) via the <select> element. An attacker can sup CVE-2026-175296.3A vulnerability was identified in AstrBotDevs AstrBot up to 4.25.5. Affected is an unknown function of the file astrbot/core/astr_main_agent CVE-2026-17536.8The Gutena Forms WordPress plugin before 1.6.1 does not validate option to be updated, which could allow contributors and above role to upd CVE-2026-175306.3A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.5. Affected by this vulnerability is the function _build_handoff_tools CVE-2026-175315.0A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by this issue is some unknown functionality of the file server/CVE-2026-175326.1The Seraphinite Accelerator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'seraph_accel_prep' parameter in ve CVE-2026-175337.2The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import functionality to network adminis CVE-2026-175345.5Kimi Code (@moonshot-ai/kimi-code) before 0.27.0 implements FetchURL SSRF hardening as a static hostname and IP-literal denylist in assertSa CVE-2026-175356.2Velociraptor's NTFS parsing library mishandles several out of bound and memory exhaustion bugs which may be triggered by maliciously crafted