CVE-2026-53486

What it actually does

Archive extraction creates files and links outside the target directory because hardlink and symlink entries are created without checking target paths, path containment relies on string prefix comparison, and file modes do not strip setuid, setgid, or sticky bits.

Why it matters to the business

Attackers may read or write arbitrary files on systems using vulnerable archive extraction, enabling data theft or unauthorized modification with low immediate risk due to stable low exploit probability and absence from known exploitation lists.

How an attack unfolds

An attacker crafts a malicious archive containing symlinks or hardlinks pointing outside the intended directory and supplies it to an application using the vulnerable extraction logic, resulting in files being written or read beyond the target path.

How to fix it

Upgrade @xhmikosr/decompress to 10.2.1 or 11.1.3; for affected dotnet8-0-main on Red Hat apply package update to 8.0.128-1.2.hum1.

How to confirm the fix worked

Verify installed package versions against fixed releases and test extraction of crafted archives containing symlinks to confirm containment within target directory.

Typical attack path

1. Craft archive with symlink or hardlink entries targeting paths outside extraction directory
2. Deliver archive to application or service performing extraction
3. Trigger extraction without path validation or mode sanitization
4. Access or modify files created outside intended boundaries

How to detect it

Review application logs and file system activity for unexpected file or link creation outside designated extraction directories during archive processing.

What your security team should do

• Apply available package updates immediately given 103 days since publication
• Audit all uses of archive extraction libraries for path traversal protections
• Monitor EPSS and KEV status for changes in exploit likelihood