By vendor

Decompress_project vulnerabilities

Known CVEs affecting Decompress_project products, prioritized by severity, with SEC.co remediation and detection guidance.

3 published vulnerabilities

• CVE-2026-39246HIGH 7.5

  The decompress library before version 4.2.2 has a vulnerability that allows attackers to create arbitrary symbolic links (symlinks) when extracting archive files. An attacker can craft a malicious archive that, when extracted, creates symlinks pointing to sensitive system files outside the intended extraction directory. This could allow an attacker to trick the application into reading or exposing sensitive information like system passwords. The vulnerability requires no authentication and can be triggered remotely if the application processes untrusted archives.

• CVE-2026-39245MEDIUM 6.2

  The decompress package before version 4.2.2 contains a path validation flaw that allows attackers to write files outside the intended extraction directory. When decompressing archives, the library checks whether extracted files stay within a safe folder, but the check uses a string-matching approach that can be bypassed. For example, a path like '/tmp/app_config' would incorrectly pass validation for the directory '/tmp/app' because the string '/tmp/app' appears at the start of it—even though they are different directories. An attacker can exploit this to place malicious files in adjacent directories, potentially compromising the application or system.

• CVE-2026-39243MEDIUM 5.5

  decompress before version 4.2.2 contains a vulnerability that allows attackers to create hardlinks to arbitrary files on a system during archive extraction. When a malicious archive is extracted, an attacker can craft hardlink entries that point to sensitive files elsewhere on the filesystem, creating a link inside the extraction directory that shares the same underlying file. This enables the attacker to read the contents of files they shouldn't have access to, or potentially modify those files. The vulnerability requires user interaction (extracting an archive) but doesn't require elevated privileges to exploit.