Cyber Resilience

CVE-2026-56876

High

Published: 26 June 2026

Published
26 June 2026
Modified
30 June 2026
KEV Added
—
Patch
—
CVSS Score v4 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0032 23.8th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-56876 is a high-severity Path Traversal (CWE-22) vulnerability in Githubusercontent (inferred from references). Its CVSS base score is 8.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability details

extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory.…

more

Depending on how extract-zip is used, an attacker could read or write to arbitrary files.

CWE(s)
CWE-22CWE-61

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Path traversal via unvalidated symlinks in zip extraction enables arbitrary file read/write when processing attacker-supplied archives in an application, directly facilitating exploitation of public-facing apps.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-24479Shared CWE-22
CVE-2025-59304Shared CWE-22
CVE-2024-39787Shared CWE-22
CVE-2025-66262Shared CWE-22
CVE-2024-31451Shared CWE-22
CVE-2025-11746Shared CWE-22
CVE-2025-11941Shared CWE-22
CVE-2024-56286Shared CWE-22
CVE-2025-54450Shared CWE-22
CVE-2024-36512Shared CWE-22

Affected Assets

Githubusercontent
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SI-10 Information Input Validation
addresses: CWE-22

Validates pathnames and filenames to prevent traversal outside intended directories.

Hardening callouts derived

Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).

Oracle Linux 8 (1 rule)
  • V-248577 OL 8 must enable kernel parameters to enforce Discretionary Access Control (DAC) on symlinks. via CWE-61
RHEL 8 (1 rule)
  • V-230263 The RHEL 8 file integrity tool must notify the system administrator when changes to the baseline configuration or anomalies in the operation of any security functions are discovered within an organizationally defined frequency. via CWE-61

References