StackRadar

CVE-2026-56876

High

Advisory

Published 26 Jun 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
8.1
base score, highest
EPSS
0.004
33rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
75
of 17,781 indexed, latest versions
Container images
74
deployed by those charts
Fix available
None
affected package

extract-zip unvalidated symlink path traversal

Carried by container images the latest versions of 75 of 17,781 indexed charts deploy, on 74 images.

Affected packageAffected versionsFixed inImages
extract-zipnpm1.5.0, 1.6.5, 1.6.6, 1.6.7+2 moreno fix listed74
OSV records
GHSA-jmr9-qjv8-65gv

Charts affected

75 by stars
ChartLatestAffected imagesRadar Score
monocularmonocular1.4.151 of 5See more

monocular monocular 1.4.15

1 of the 5 container images this version deploys carry CVE-2026-56876.

Container imageDigestPackageFixed in
migmartri/prerender:latest486aacfd5aa9
extract-zip@1.5.0
no fix listed

Open the chart page →

7,048
tianjimsgbyte0.1.171 of 2See more

tianji msgbyte 0.1.17

1 of the 2 container images this version deploys carry CVE-2026-56876.

Container imageDigestPackageFixed in
moonrailgun/tianji:1.11.2b528c8f8fcc4
extract-zip@2.0.1
no fix listed

Open the chart page →

4,560
ghostmt1905028.25.11 of 3See more

ghost mt190502 8.25.1

1 of the 3 container images this version deploys carry CVE-2026-56876.

Container imageDigestPackageFixed in
library/ghost:6.25.12654b1e90413
extract-zip@2.0.1
no fix listed

Open the chart page →

4,960
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.01 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

1 of the 40 container images this version deploys carry CVE-2026-56876.

Container imageDigestPackageFixed in
library/arangodb:3.11.81e75d74954a4
extract-zip@2.0.1
no fix listed

Open the chart page →

71,208
yetiosdfir-infrastructureVerified publisher1.0.51 of 4See more

yeti osdfir-infrastructure 1.0.5

1 of the 4 container images this version deploys carry CVE-2026-56876.

Container imageDigestPackageFixed in
library/arangodb:3.11.81e75d74954a4
extract-zip@2.0.1
no fix listed

Open the chart page →

6,583
codimdphntom0.1.121 of 3See more

codimd phntom 0.1.12

1 of the 3 container images this version deploys carry CVE-2026-56876.

Container imageDigestPackageFixed in
phntom/codimd:2.4.31b9aafbb62e6
extract-zip@1.7.0
no fix listed

Open the chart page →

6,524
gristrlex0.1.01 of 1See more

grist rlex 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-56876.

Container imageDigestPackageFixed in
gristlabs/grist:0.7.96e71b1914a7e
extract-zip@1.7.0
no fix listed

Open the chart page →

5,215
web-checkrm3lVerified publisher0.1.01 of 1See more

web-check rm3l 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-56876.

Container imageDigestPackageFixed in
ghcr.io/lissy93/web-check:latesta4e021c0f6a9
extract-zip@1.7.0
no fix listed

Open the chart page →

9,047
rybbitrybbit-helm1.3.01 of 7See more

rybbit rybbit-helm 1.3.0

1 of the 7 container images this version deploys carry CVE-2026-56876.

Container imageDigestPackageFixed in
ghcr.io/rybbit-io/rybbit-backend:lateste0d1b397e33c
extract-zip@2.0.1
no fix listed

Open the chart page →

5,819
rsshubsb-helm-charts0.3.01 of 1See more

rsshub sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-56876.

Container imageDigestPackageFixed in
diygod/rsshub:2025-11-097a6312cac0d5
extract-zip@2.0.1
no fix listed

Open the chart page →

4,684
speckle-preview-service-branch-testing6speckleVerified publisher2.23.14-branch.testing6.334655-b4e04ee1 of 1See more

speckle-preview-service-branch-testing6 speckle 2.23.14-branch.testing6.334655-b4e04ee

1 of the 1 container images this version deploys carry CVE-2026-56876.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.23.14-branch.testing6.334655-b4e04ee6dee853ba74a
extract-zip@2.0.1
no fix listed

Open the chart page →

5,950
speckle-server-branch-hotfix-2.19.1speckleVerified publisher2.19.2-branch.hotfix-2.19.1.124125-665e7e11 of 5See more

speckle-server-branch-hotfix-2.19.1 speckle 2.19.2-branch.hotfix-2.19.1.124125-665e7e1

1 of the 5 container images this version deploys carry CVE-2026-56876.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.19.2-branch.hotfix-2.19.1.124125-665e7e1c102b087481a
extract-zip@2.0.1
no fix listed

Open the chart page →

16,368
speckle-server-branch-hotfix-2.20.2speckleVerified publisher2.20.3-branch.hotfix-2.20.2.149555-37ea0cb1 of 5See more

speckle-server-branch-hotfix-2.20.2 speckle 2.20.3-branch.hotfix-2.20.2.149555-37ea0cb

1 of the 5 container images this version deploys carry CVE-2026-56876.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.20.3-branch.hotfix-2.20.2.149555-37ea0cbd3da0a84de98
extract-zip@2.0.1
no fix listed

Open the chart page →

16,400
speckle-server-branch-testingspeckleVerified publisher2.17.14-branch.testing.72707.921a5f81 of 5See more

speckle-server-branch-testing speckle 2.17.14-branch.testing.72707.921a5f8

1 of the 5 container images this version deploys carry CVE-2026-56876.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.17.14-branch.testing.72707.921a5f884fc39bca0c8
extract-zip@2.0.1
no fix listed

Open the chart page →

14,679
speckle-server-branch-testing1speckleVerified publisher2.20.6-branch.testing1.154030-9b091141 of 5See more

speckle-server-branch-testing1 speckle 2.20.6-branch.testing1.154030-9b09114

1 of the 5 container images this version deploys carry CVE-2026-56876.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.20.6-branch.testing1.154030-9b091148f3c1ea153ba
extract-zip@2.0.1
no fix listed

Open the chart page →

16,400
speckle-server-branch-testing2speckleVerified publisher2.18.11-branch.testing2.88634-335d4691 of 5See more

speckle-server-branch-testing2 speckle 2.18.11-branch.testing2.88634-335d469

1 of the 5 container images this version deploys carry CVE-2026-56876.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.18.11-branch.testing2.88634-335d4694bd113093583
extract-zip@2.0.1
no fix listed

Open the chart page →

14,221
speckle-server-branch-testing3speckleVerified publisher2.18.12-branch.testing3.88744-f55b3411 of 5See more

speckle-server-branch-testing3 speckle 2.18.12-branch.testing3.88744-f55b341

1 of the 5 container images this version deploys carry CVE-2026-56876.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.18.12-branch.testing3.88744-f55b3414bd113093583
extract-zip@2.0.1
no fix listed

Open the chart page →

14,221
speckle-server-branch-testing4speckleVerified publisher2.20.2-branch.testing4.134160-9fad4b21 of 5See more

speckle-server-branch-testing4 speckle 2.20.2-branch.testing4.134160-9fad4b2

1 of the 5 container images this version deploys carry CVE-2026-56876.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.20.2-branch.testing4.134160-9fad4b21f897ca906ea
extract-zip@2.0.1
no fix listed

Open the chart page →

16,019
speckle-server-branch-testing5speckleVerified publisher2.21.3-branch.testing5.219631-2153bef1 of 5See more

speckle-server-branch-testing5 speckle 2.21.3-branch.testing5.219631-2153bef

1 of the 5 container images this version deploys carry CVE-2026-56876.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.21.3-branch.testing5.219631-2153bef52cad5e3293e
extract-zip@2.0.1
no fix listed

Open the chart page →

15,635
speckle-server-branch-testing6speckleVerified publisher2.25.10-branch.testing6.645-b125c1e1 of 4See more

speckle-server-branch-testing6 speckle 2.25.10-branch.testing6.645-b125c1e

1 of the 4 container images this version deploys carry CVE-2026-56876.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.25.10-branch.testing6.645-b125c1e787adcb20a3a
extract-zip@2.0.1
no fix listed

Open the chart page →

11,100
lodestar-validatorstakewise1.2.01 of 1See more

lodestar-validator stakewise 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-56876.

Container imageDigestPackageFixed in
chainsafe/lodestar:v1.27.07b9fe4aa8073
extract-zip@2.0.1
no fix listed

Open the chart page →

4,052
browserlessvictorlane0.2.01 of 1See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-56876.

Container imageDigestPackageFixed in
ghcr.io/browserless/chromium:v2.43.0853e6f105b51
extract-zip@2.0.1
no fix listed

Open the chart page →

4,305
kibanawiremindVerified publisher8.5.231 of 2See more

kibana wiremind 8.5.23

1 of the 2 container images this version deploys carry CVE-2026-56876.

Container imageDigestPackageFixed in
library/kibana:8.18.004c0fc150f3a
extract-zip@2.0.1
no fix listed

Open the chart page →

6,285
opendistro-eswitcom-gmbh1.13.31 of 3See more

opendistro-es witcom-gmbh 1.13.3

1 of the 3 container images this version deploys carry CVE-2026-56876.

Container imageDigestPackageFixed in
amazon/opendistro-for-elasticsearch-kibana:1.13.2c740d7a89475
extract-zip@1.7.0
no fix listed

Open the chart page →

5,806
sockpuppetbrowserzekker6Verified publisher0.1.01 of 1See more

sockpuppetbrowser zekker6 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-56876.

Container imageDigestPackageFixed in
dgtlmoon/sockpuppetbrowser:latestf166a963b550
extract-zip@2.0.1
no fix listed

Open the chart page →

1,589

Container images carrying it

74 by charts deploying them

A fixed version is listed for 0 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
amazon/opendistro-for-elasticsearch-kibana:1.13.2c740d7a89475
extract-zip@1.7.0
no fix listed
2
library/arangodb:3.11.81e75d74954a4
extract-zip@2.0.1
no fix listed
2
library/ghost:6.63.0e05bc1169fb2
extract-zip@2.0.1
no fix listed
2
migmartri/prerender:latest486aacfd5aa9
extract-zip@1.5.0
no fix listed
2
opensearchproject/opensearch-dashboards:1.0.039695180364b
extract-zip@1.7.0
no fix listed
2
speckle/speckle-preview-service:2.18.11-branch.testing2.88634-335d469:2.18.12-branch.testing3.88744-f55b3414bd113093583
extract-zip@2.0.1
no fix listed
2
ghcr.io/lissy93/web-check:latesta4e021c0f6a9
extract-zip@1.7.0
no fix listed
2
activepieces/activepieces:0.90.430c10a04fe3d
extract-zip@2.0.1
no fix listed
1
aktosecurity/akto-puppeteer-replay:doom_latest853e37321e6e
extract-zip@2.0.1
no fix listed
1
assistiot/cybersecurity-monitoring_id-kbn:latest2297b4350211
extract-zip@1.7.0
no fix listed
1
assistiot/cybersecurity-monitoring_ir-kbn:latest0570b27bb7c2
extract-zip@2.0.1
no fix listed
1
bastilimbach/docker-magicmirror:v2.15.041b0835ab31e
extract-zip@1.7.0
no fix listed
1
browserless/chrome:1.48.0-chrome-stablec81ae5585b47
extract-zip@2.0.1
no fix listed
1
budibase/apps:3.41.344fe6feab985
extract-zip@2.0.1
no fix listed
1
chainsafe/lodestar:v1.27.07b9fe4aa8073
extract-zip@2.0.1
no fix listed
1
countly/api:25.05.4f4cc7447c4f5
extract-zip@2.0.1
no fix listed
1
countly/countly-server:25.05.4e3c238248f99
extract-zip@2.0.1
no fix listed
1
dacinfomotion/h2p:latest68fa393b472c
extract-zip@2.0.1
no fix listed
1
dgtlmoon/sockpuppetbrowser:latestf166a963b550
extract-zip@2.0.1
no fix listed
1
diygod/rsshub:2025-11-097a6312cac0d5
extract-zip@2.0.1
no fix listed
1
enketo/enketo-express:3.0.4dcad9c2273f6
extract-zip@2.0.1
no fix listed
1
gristlabs/grist:0.7.96e71b1914a7e
extract-zip@1.7.0
no fix listed
1
ibmcom/microclimate-portal:latested5505e5c7ec
extract-zip@1.6.6
no fix listed
1
ibmcom/microclimate-theia:lateste17bdccc5030
extract-zip@1.6.6
no fix listed
1
konradkleine/docker-registry-frontend:v2181aad54ee64
extract-zip@1.6.5
no fix listed
1
koumoul/capture:17108d47be3b2
extract-zip@1.6.7
no fix listed
1
library/ghost:6.37.01ef2e532ca4d
extract-zip@2.0.1
no fix listed
1
library/ghost:6.25.12654b1e90413
extract-zip@2.0.1
no fix listed
1
library/ghost:6.41.129773d6be407
extract-zip@2.0.1
no fix listed
1
library/ghost:4.37.0767230c0f263
extract-zip@2.0.1
no fix listed
1
library/ghost:6.39.0-alpine77196da4b0df
extract-zip@2.0.1
no fix listed
1
library/ghost:5.79.083f7bf209844
extract-zip@2.0.1
no fix listed
1
library/ghost:6.62.0a7a268bbfb7f
extract-zip@2.0.1
no fix listed
1
library/ghost:6.22.0-alpine3.23ac533a6988ee
extract-zip@2.0.1
no fix listed
1
library/kibana:7.17.150172f1c538e7
extract-zip@2.0.1
no fix listed
1
library/kibana:8.18.004c0fc150f3a
extract-zip@2.0.1
no fix listed
1
library/kibana:7.17.8c5781ba340ef
extract-zip@2.0.1
no fix listed
1
library/kibana:7.17.3e2e2031c15be
extract-zip@2.0.1
no fix listed
1
litlyx/litlyx-dashboard:lateste64ff2d52385
extract-zip@2.0.1
no fix listed
1
moonrailgun/tianji:1.11.2b528c8f8fcc4
extract-zip@2.0.1
no fix listed
1
opensearchproject/opensearch-dashboards:2.10.0485a0019e5d6
extract-zip@2.0.1
no fix listed
1
opensearchproject/opensearch-dashboards:2.15.0b7c26c60bfaf
extract-zip@2.0.1
no fix listed
1
phntom/codimd:2.4.31b9aafbb62e6
extract-zip@1.7.0
no fix listed
1
speckle/speckle-preview-service:2.26.3092384dba45d
extract-zip@2.0.1
no fix listed
1
speckle/speckle-preview-service:2.20.2-branch.testing4.134160-9fad4b21f897ca906ea
extract-zip@2.0.1
no fix listed
1
speckle/speckle-preview-service:2.21.3-branch.testing5.219631-2153bef52cad5e3293e
extract-zip@2.0.1
no fix listed
1
speckle/speckle-preview-service:2.23.14-branch.testing6.334655-b4e04ee6dee853ba74a
extract-zip@2.0.1
no fix listed
1
speckle/speckle-preview-service:2.25.10-branch.testing6.645-b125c1e787adcb20a3a
extract-zip@2.0.1
no fix listed
1
speckle/speckle-preview-service:2.17.14-branch.testing.72707.921a5f884fc39bca0c8
extract-zip@2.0.1
no fix listed
1
speckle/speckle-preview-service:2.20.6-branch.testing1.154030-9b091148f3c1ea153ba
extract-zip@2.0.1
no fix listed
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.