By vendor

Max-Mapper vulnerabilities

Known CVEs affecting Max-Mapper products, prioritized by severity, with SEC.co remediation and detection guidance.

1 published vulnerability

• CVE-2026-56876HIGH 8.1

  extract-zip, a popular Node.js package for unzipping files, fails to validate symlink targets during extraction. An attacker can craft a malicious zip archive containing symlinks with path traversal sequences (e.g., '../../../../etc/passwd') that point outside the intended extraction directory. When the library extracts these symlinks without validation, it creates links to arbitrary filesystem locations. Depending on the application's usage pattern and file permissions, this could enable an attacker to read sensitive files or overwrite critical data.