CVE-2026-17514 | A vulnerability was determined in ZJONSSON node-unzipper up … | CVSS 5.3 MEDIUM

Description

A vulnerability was determined in ZJONSSON node-unzipper up to 0.12.3. Affected by this vulnerability is the function Extract of the file lib/extract.js. This manipulation causes path traversal. The attack requires local access. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

Metadata

CVE ID: CVE-2026-17514
State: PUBLISHED
Assigner: VulDB
Reserved: 2026-07-27 07:18 UTC
Published: 2026-07-27 13:15 UTC
Last updated: 2026-07-27 13:48 UTC
Primary CWE: CWE-22
Path Traversal
Vendor / Product: ZJONSSON / node-unzipper
Sources: cve.org · NVD

Severity & Metrics

5.3 MEDIUM CVSS 3.1

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
ZJONSSON	node-unzipper	—	0.12.0, 0.12.1, 0.12.2, 0.12.3

Weakness (CWE)

CWE	Source	Description
CWE-22	cna	Path Traversal

CVSS scores (4)

Score	Severity	Version	Source	Vector
5.3	MEDIUM	3.1	cna	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
5.3	MEDIUM	3.0	cna	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
4.8	MEDIUM	4.0	cna	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
4.3	N/D	2.0	cna	AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR

References (6)

VDB-383384 | ZJONSSON node-unzipper extract.js Extract path traversal https://vuldb.com/vuln/383384
VDB-383384 | CTI Indicators (IOB, IOC, TTP, IOA) https://vuldb.com/vuln/383384/cti
CVE-2026-17514 | CVE Analysis and Report https://vuldb.com/cve/CVE-2026-17514
Submit #862473 | ZJONSSON node-unzipper 0.12.3 Path Traversal https://vuldb.com/submit/862473
https://github.com/ZJONSSON/node-unzipper/issues/357
https://github.com/ZJONSSON/node-unzipper/