{"id":"CVE-2026-107709","published":"2026-10-08T17:17:16.293","lastModified":"2026-10-08T21:17:52.420","description":"A path traversal vulnerability exists in Bower decompress-zip through version 0.3.3. The vulnerability located in `lib/decompress-zip.js` improperly validates archive entry paths during ZIP extraction. A crafted ZIP archive containing entries that resolve to prefix-sibling directories can cause files to be written outside the intended extraction directory. Successful exploitation may allow arbitrary file overwrite, application compromise, or remote code execution depending on the target environment and writable sibling paths.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://github.com/bower/decompress-zip","tags":[]},{"url":"https://moizxsec.github.io/writeups/decompress-zip-zip-slip-sibling-prefix-bypass/","tags":[]}],"exploitRefs":[{"url":"https://github.com/bower/decompress-zip","tags":[]}],"hasPoc":true,"ai":{"summary":"A path traversal vulnerability in Bower's decompress-zip library allows attackers to write files outside the intended extraction directory by crafting malicious ZIP archives with prefix-sibling directory paths. This can lead to arbitrary file overwrites and potential remote code execution.","exploitability":"Exploitation requires a victim to process a crafted ZIP archive through the vulnerable decompress-zip library, typically involving user interaction or automated processing of untrusted archives, with no additional preconditions beyond the vulnerable library version.","blast_radius":"The vulnerability could affect any application using Bower's decompress-zip library for ZIP extraction, potentially allowing attackers to overwrite critical application files or execute arbitrary code in the context of the running application.","remediation":"Upgrade to decompress-zip version 0.3.4 or later to fix the path traversal vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["path-traversal","file-overwrite","zip"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:21:57.517Z"}}