CVE-2026-39245

decompress before 4.2.2 contains an improper path containment check that enables directory traversal and arbitrary file write. The safeMakeDir function (index.js line 29) and the extraction path validation (index.js line 106) use String.indexOf() to verify the resolved path is within the output directory: realDestinationDir.indexOf(realOutputPath) !== 0. This check is flawed because it does not enforce a path separator boundary. For example, "/tmp/app_config".indexOf("/tmp/app") returns 0, incorrectly passing the check even though /tmp/app_config is outside /tmp/app. Combined with the unvalidated symlink creation in the same package, an attacker can write arbitrary files to directories adjacent to the extraction target. This is a bypass of the fix for CVE-2020-12265. The correct check requires appending a path separator: realParentPath.indexOf(realOutputPath + path.sep) !== 0.

• CWE-22

• https://github.com/kevva/decompressProduct
• https://github.com/kevva/decompress/issues/115Exploit, Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12265US Government Resource
• https://www.npmjs.com/package/decompressProduct
• https://github.com/kevva/decompress/issues/115Exploit, Vendor Advisory

Published

Jul 9, 2026

Last Modified

Jul 13, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-3922Use after free in MediaStream in Google Chrome prior to 146.…8.8
• CVE-2026-39229Bolt CMS through 3.7.0 allows SQL Injection in the 'order' p…6.5
• CVE-2026-3923Use after free in WebMIDI in Google Chrome prior to 146.0.76…8.8
• CVE-2026-3924use after free in WindowDialog in Google Chrome prior to 146…7.5
• CVE-2026-39243decompress before 4.2.2 allows arbitrary hardlink creation d…5.5
• CVE-2026-39244adm-zip before 0.5.18 is vulnerable to denial of service via…7.5
• CVE-2026-39246decompress before 4.2.2 allows arbitrary symlink creation du…7.5
• CVE-2026-3925Incorrect security UI in LookalikeChecks in Google Chrome on…4.3
• CVE-2026-39250An authorization vulnerability exists in Innoshop 0.6.0. Aft…7.3
• CVE-2026-39253An issue in Pivotal CRM v.6.6.04.08 allows a remote attacker…8.1
• CVE-2026-3926Out of bounds read in V8 in Google Chrome prior to 146.0.768…8.8
• CVE-2026-3927Incorrect security UI in PictureInPicture in Google Chrome p…4.3