CVE-2026-107709

UNKNOWN 0.0

Bower decompress-zip has a path traversal vulnerability

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

A path traversal vulnerability exists in Bower decompress-zip through version 0.3.3. The vulnerability located in `lib/decompress-zip.js` improperly validates archive entry paths during ZIP extraction. A crafted ZIP archive containing entries that resolve to prefix-sibling directories can cause files to be written outside the intended extraction directory. Successful exploitation may allow arbitrary file overwrite, application compromise, or remote code execution depending on the target environment and writable sibling paths.

Vendor	bower decompress-zip
Product	decompress-zip
Published	Oct 8, 2026

Stay Ahead of the Next One

Get instant alerts for bower decompress-zip decompress-zip

Be the first to know when new unknown vulnerabilities affecting bower decompress-zip decompress-zip are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Bower Decompress-Zip / decompress-zip

0 ≤ 0.3.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/bower/decompress-zip moizxsec.github.io: https://moizxsec.github.io/writeups/decompress-zip-zip-slip-sibling-prefix-bypass/