Symlink-chain path traversal in decompress exposes archive escapes

At a glance

What this is: This is a critical path traversal flaw in @xhmikosr/decompress that can make crafted archive entries escape the intended extraction directory.

Why it matters: It matters because archive extraction often touches build systems, deployment pipelines, and service workflows where a write outside the target tree can become code execution, configuration tampering, or broader host compromise.

By the numbers:

• CVE-2026-101894 is rated critical with a CVSS v3.1 score of 9.1 / 10.
• The vulnerability affects @xhmikosr/decompress 11.0.0 through 11.1.3 and 10.2.1 and earlier.
• The supplied 300-attempt sessions recorded 19 outside writes on 11.1.3 and 20 on 10.2.1.
• The directory-only probe created an empty outside sibling directory in 24 of 25 attempts on both vulnerable releases.

Context

Archive extraction is supposed to unpack files inside a chosen destination, but path traversal breaks that boundary when link resolution is mishandled. In this case, crafted symlink chains can alter where later archive entries land, which is why simple path checks are not enough for safe extraction.

For IAM and NHI practitioners, this is a reminder that the same trust problem appears in build agents, deployment jobs, and other automated workflows that process untrusted archives. A file-write primitive outside the intended directory can turn a routine utility into a control-plane risk, even before any application code runs.

Key questions

Q: What breaks when archive extraction trusts symlink chains inside untrusted files?

A: The extractor can write outside the intended destination because the path that looks safe lexically may resolve to a different place once the filesystem follows planted links. That turns a normal unpacking step into an out-of-bounds write primitive. In practice, the failure is boundary enforcement, not mere path parsing.

Q: Why do archive path traversal bugs create such high operational risk?

A: They can change host state during ordinary automation, including overwriting files, planting directories, or preparing later execution paths. Because archive handling often runs with service or build privileges, the attacker inherits the trust of the process rather than needing a separate login. That makes the impact disproportionate to the triggering input.

Q: What are the signs that archive containment checks are failing?

A: Look for extraction results that vary across repeated runs, especially when the same archive sometimes stays inside the target tree and sometimes creates outside files or directories. Race sensitivity, unexpected EEXIST outcomes, and discrepancies between lexical checks and real filesystem paths are strong warning signs. Those symptoms mean the control is not deterministic enough to trust.

Q: How should teams isolate archive processing from broader host access?

A: Use a low-privilege process, limit the filesystem namespace it can see, and make sure the extraction account cannot reach paths outside the intended staging area. The goal is to prevent a single malformed archive from turning into host-level tampering. Isolation does not fix the flaw, but it sharply reduces the blast radius.

Technical breakdown

How symlink chains defeat archive containment checks

The vulnerable flow resolves an archive entry against the target directory, then applies a containment check that assumes the resolved path still represents the final filesystem location. That assumption fails when a planted symlink changes the meaning of later path components such as .. during extraction. Once the archive creates one link and then writes a regular file through that link, the resulting path can escape the intended tree even though the earlier lexical check appeared to pass. The important technical issue is not path concatenation alone, but the gap between lexical normalisation and actual filesystem resolution. See the Zero-Day and Exploited Vulnerabilities Guide.

Practical implication: Treat archive containment as a filesystem-resolution problem, not a string-matching problem.

Why extraction order matters in concurrent archive processing

The article shows that non-hardlink entries can be extracted concurrently, which introduces a race between planting a symlink and writing the next file entry. If the directory entry is created first, the symlink write may fail with EEXIST; if the symlink lands first, a later file-parent check can follow it outside the target directory. That means the same archive can sometimes stay inside and sometimes escape, depending on scheduler timing and filesystem state. Concurrency therefore becomes part of the attack surface, not just a performance detail.

Practical implication: Serialise or sandbox archive extraction when control flow depends on link creation order.

Why post-extraction validation is too late

The fix changes the sequencing so files and directories are handled before symlinks, then escaped symlinks are removed and rejected. It also rechecks resolved paths after more of the filesystem state exists, which closes the gap that let a missing target return ENOENT and fall back to an unsafe lexical result. This is a useful pattern for any extractor, unpacker, or deployment workflow that handles untrusted content: once a file has been written outside the intended boundary, the control failure has already happened, even if later validation notices it.

Practical implication: Enforce boundary checks before writes occur, not after extraction completes.

Threat narrative

Attacker objective: The attacker wants arbitrary file placement outside the extraction directory so they can tamper with host state or prepare downstream execution.

1. Entry occurs when an attacker supplies a crafted archive containing symlink chains and path traversal components that the extractor trusts.
2. Credential_harvested is not the main stage here; the abuse is filesystem trust, where link resolution and extraction order create the opening for escape.
3. Escalation happens when the archive follows the planted symlink and writes a file or directory outside the intended output tree.
4. Impact is an out-of-bounds file write that can overwrite host files, alter startup material, or prepare a later execution path.

Breaches seen in the wild

• Gravity SMTP CVE-2026-4020 API Keys Exposure: CVE-2026-4020 in Gravity SMTP exposes API keys via single HTTP request across 100,000 WordPress sites.
• Gladinet Hard-Coded Keys RCE Exploitation: Actively exploited hard-coded keys in Gladinet CentreStack and Triofox enable remote code execution.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Archive extraction is a governance problem when automation trusts filesystem paths. The article shows that a routine utility can become a boundary-breaking write primitive when a workflow extracts attacker-controlled content without controlling link resolution. That matters for CI/CD jobs, deployment agents, and any service that treats archive contents as implicitly safe. Practitioners should treat extraction boundaries as a policy control, not a convenience setting.

Symlink-chain path traversal is a more precise failure mode than generic path traversal. The issue is not merely that a path contains .., but that the extractor accepts a link chain whose meaning changes once the kernel resolves it. That distinction matters because many controls only inspect the string form of a path, while the exploit succeeds in the resolved filesystem state. exploited vulnerability handling should therefore be paired with runtime checks that understand link semantics.

Concurrent extraction can turn a containment bug into an intermittent operational risk. The article’s race-dependent results show that one attempt may fail safely while another escapes, which is exactly the sort of behaviour that slips past one-off tests and shallow assurance checks. This is why resilience teams need deterministic validation for archive processors, especially where automation handles untrusted uploads or supply-chain inputs.

OWASP NHI exposure is relevant here because archive-processing services often run with standing filesystem privilege. When a service account, build agent, or workload identity can write across a broad host path, a single extraction flaw can become a much larger trust failure. The control lesson is not just about archives, but about how much ambient authority the extraction process carries into the host environment. Practitioners should narrow that authority to the minimum boundary needed.

Named concept: extraction-time boundary collapse. This article describes a control failure where containment is evaluated before the filesystem state that ultimately decides the write location is fully settled. That is a distinct governance gap from ordinary path sanitisation, and it explains why the same archive can be safe in one run and unsafe in another. Security teams should map this failure mode to their controls for automation, privilege, and host isolation.

What this signals

Extraction-time boundary collapse: archive processors need controls that understand the difference between a path that looks contained and a path that is actually contained after link resolution. In automation-heavy environments, that distinction matters as much as malware detection because the exploit is a write primitive, not a payload binary.

Security teams should expect more bugs of this shape wherever services unpack untrusted content with ambient host access. The practical response is to combine sandboxing, deterministic validation, and narrow filesystem permissions, because one control alone rarely closes both the race and the traversal angle.

For practitioners

• Harden archive extraction boundaries Run untrusted archive extraction in a dedicated process with the smallest possible filesystem view and no direct access to sensitive host paths.
• Reject link-based archive escapes Validate symlink and hardlink targets against the real destination tree before any file write is committed, not after extraction returns.
• Restrict service-account write scope Limit the credentials and filesystem permissions used by build agents and deployment workers so a single archive cannot overwrite arbitrary host files.
• Test extraction under race conditions Reproduce archive handling with repeated runs and mixed scheduling so you can detect intermittent containment failures that a single clean test will miss.

Key takeaways

• The core issue is not simple path parsing but a filesystem boundary failure that lets crafted archive entries escape the intended directory.
• Safe Security’s testing recorded outside writes on vulnerable releases and no outside writes on the fixed releases, showing that the bug is reproducible and patchable.
• Teams should treat archive extraction as a privileged operation and constrain it with sandboxing, strict path validation, and minimal write scope.

Related NHI Mgmt Group resources: Zero-Day and Exploited Vulnerabilities Guide · Vulnerability Management Guide · MITRE ATT&CK Guide for Defenders · Top 10 API Security Risks

Key terms

• Path Traversal: A bug where crafted path segments such as ../ allow input to escape an intended directory boundary. In practice, it turns a normal file operation into a boundary break, which is especially dangerous when the affected service runs with non-human identity privileges and touches production data or secrets.
• Symlink Chain: A symlink chain is a sequence of symbolic links that changes how the filesystem resolves a later path component. In security testing, chained links matter because the final resolved location may differ from the lexical path the application thought it had validated.
• Extraction-Time Write: An extraction-time write is a file or directory created while an archive is being unpacked, rather than by a later application action. This distinction matters because it shows the archive handler itself is the abuse point, not a downstream consumer.
• Filesystem Boundary Validation: Filesystem boundary validation is the practice of proving that a derived path remains inside an approved base directory before any file operation occurs. It is stronger than simple string checks because it evaluates the resolved location, not just the text of the input, and blocks traversal-based escapes.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.