A malicious zip archive can contain a symbolic link whose target points to a location outside the intended extraction directory. The extract‑zip library does not targets, allowing the link to be created exactly as specified. This results in a directory traversal and symlink abuse vulnerability (CWE‑22 and CWE‑61). When an attacker supplies such an archive, they can gain read or write access to arbitrary files on the host, potentially exposing sensitive data or overwriting configuration files, which could lead to broader compromise if the application runs with elevated privileges.

The vulnerability affects the max‑mapper:extract‑zip library. No specific version information is provided in the CNA data, so all versions that incorporate the unvalidated symlink handling are potentially impacted.

The CVSS score of 8.6 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is the delivery of a crafted zip file to any application that processes unzip. If such processing occurs, the attacker can readily trim a symlink to point to a protected location, read or write arbitrary files, and thereby cause serious confidentiality or integrity impacts.