Skip to main content

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in decompress

CVE-2026-39245

  • decompress
Medium
6.2/10

Summary

decompress contains an improper path containment check that enables directory traversal and arbitrary file write. The `safeMakeDir` function (index.js line 29) and the extraction path validation (index.js line 106) use `String.indexOf()` to verify the resolved path is within the output directory: `realDestinationDir.indexOf(realOutputPath) !== 0`. This check is flawed because it does not enforce a path separator boundary. For example, "/tmp/app_config".indexOf("/tmp/app") returns 0, incorrectly passing the check even though `/tmp/app_config` is outside `/tmp/app`. Combined with the unvalidated symlink creation in the same package, an attacker can write arbitrary files to directories adjacent to the extraction target. The correct check requires appending a path separator: `realParentPath.indexOf(realOutputPath + path.sep) !== 0`.

  • LOW
  • LOCAL
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • NONE

CWE-22 - Path Traversal

Path traversal (or directory traversal), is a vulnerability that allows malicious users to traverse the server's root directory, gaining access to arbitrary files and folders such as application code & data, back-end credentials, and sensitive operating system files. In the worst-case scenario, an attacker could potentially execute arbitrary files on the server, resulting in a denial of service attack. Such an exploit may severely impact the integrity, confidentiality, and availability of an application.

References

Advisory Timeline

  • Published