The vulnerability stems from extract-zip’s containment checks, which only validate the parent directory of each archive entry and ignore the entry’s own final path component. An attacker can supply a ZIP file that first creates a symlink pointing outside the desired extraction directory and then includes a regular file with the same name. During extraction, the symlink is created and the following file is written through the symlink, resulting in a write to an arbitrary location on the filesystem, potentially overwriting critical files or altering application data.

This flaw exists in the Node.js package max-mapper extract-zip and affects all installations through version 2.0.1. Any JavaScript or Node.js application that uses this package to extract ZIP archives from sources that the application does not fully trust is at risk.

The CVSS score of 8.1 categorizes the flaw as high severity. No EPSS score is listed, so the exploitation probability is uncertain, and it is not present in the CISA KEV catalog. The likely attack vector requires an attacker to influence the ZIP archive processed by the application, which is feasible when the application accepts or downloads ZIP files from external parties. If the application runs with elevated privileges or has write access to critical directories, the attacker could overwrite system or application files, enabling further compromise or denial of service. This indicates a significant risk for affected deployments.