Max-mapper vulnerabilities
We track 2 vulnerabilities in Max-mapper products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on August 17, 2026.
2vulnerabilities
0critical
2high
0exploited
8.1average CVSS score
Latest Max-mapper vulnerabilities
- 8.1 High severity
extract-zip: Improper Limitation of a Pathname to a Restricted Directory
extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed
- 8.1 High severity
extract-zip: Improper Limitation of a Pathname to a Restricted Directory
extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to po