Absolute decompress up to 4.2.1 Archive Extraction index.js fs.link x.linkname path traversal

Summaryinfo

A vulnerability labeled as critical has been found in Absolute decompress up to 4.2.1. This affects the function fs.link of the file index.js of the component Archive Extraction. Such manipulation of the argument x.linkname leads to path traversal. This vulnerability is traded as CVE-2026-39243. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in Absolute decompress up to 4.2.1. It has been rated as critical. Affected by this issue is the function fs.link of the file index.js of the component Archive Extraction. The manipulation of the argument x.linkname with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. CVE summarizes:

decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries (type === 'link'), the x.linkname field from the archive is passed directly to fs.link() without validation (index.js line 113). An attacker can craft an archive with a hardlink entry whose linkname is an absolute path to any file on the same filesystem. This creates a hardlink inside the extraction directory that shares the same inode as the target file, enabling both reading and overwriting the original file's content. Hardlinks are limited to files on the same filesystem and cannot target directories.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-39243 since 04/06/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1006.

Upgrading to version 4.2.2 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Absolute

Name

• decompress

Version

• 4.2.0
• 4.2.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion