CVE-2026-76845

Name of the Vulnerable Software and Affected Versions adm-zip versions 0.5.9 through 0.6.0

Description The software follows symbolic links at the extraction destination. The Utils.sanitize function in util/utils.js fails to properly enforce containment by comparing only the string form of an archive entry name against the resolved extraction root. Additionally, the Utils.writeFileTo function uses fs.openSync(path, "w", 0o666), which resolves symbolic links and lacks both the O NOFOLLOW flag and a pre-write fs.lstatSync check. If a path component at the destination is a symbolic link pointing outside the extraction root, the functions extractAllTo, extractAllToAsync, and extractEntryTo will write entry contents through that link and modify the target's permissions. This allows an attacker who can create a symbolic link in a shared or predictable extraction directory to overwrite files the process has permission to write, provided that the overwrite option is enabled.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.