CVE-2026-76845: adm-zip 0.5.9 through 0.6.0 Arbitrary File Overwrite via Symlink Following on Extraction
adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforces containment by comparing only the string form of an archive entry name against the resolved extraction root, and Utils.writeFileTo opens the computed destination with fs.openSync(path, "w", 0o666), which resolves symbolic links and carries neither ONOFOLLOW nor a pre-write fs.lstatSync check. When a path component at the destination already exists as a symbolic link pointing outside the extraction root, extractAllTo, extractAllToAsync and extractEntryTo write the entry contents through that link and then chmod its target, placing attacker-controlled content in a file outside the root without any traversal sequence appearing in the archive. Reaching the write requires overwrite to be enabled, because the preceding fs.existsSync check also resolves the link and otherwise declines. An attacker able to create a symbolic link inside a shared, reused or predictable extraction directory, such as a temporary directory or a continuous integration workspace, can overwrite any file the extracting process is permitted to write.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
adm-zipto a version that resolves this vulnerability.Fixed in 0.6.0 - Configuration
Change the extraction write path handling so that symbolic links in destination path components are not followed (e.g., perform pre-write checks using lstatSync and open with O_NOFOLLOW semantics where available).
adm-zip (util/utils.js / extraction destination writes) symlink handling for destination paths = disable symlink following - Configuration
Update Utils.sanitize containment enforcement to compare/validate the resolved destination path components (not only the string form of the archive entry name) so that symlink-resolved writes outside the extraction root are blocked.
adm-zip (util/utils.js / Utils.sanitize) archive entry name containment check = validate against resolved destination path rather than string compare - Compensating control
Ensure the extraction process runs in an extraction directory that is not shared, reused, or predictable (e.g., avoid shared temporary directories/CI workspaces where an attacker can create symlinks).
Event History
Frequently Asked Questions
What conditions are required to exploit this issue?
The extraction operation must have overwrite enabled. An attacker must also be able to create a symbolic link within the extraction directory that points outside the extraction root, and the extracting process must have permission to write the link target.
Are default extraction settings affected?
The write path is reached only when overwrite is enabled; otherwise, the existence check sees the symbolic link and declines to write. Environments using overwrite-enabled extraction into shared, reused, or predictable directories are the relevant exposure cases.
Which extraction APIs are affected?
The affected write behavior applies to extractAllTo, extractAllToAsync, and extractEntryTo. Each can write through an existing destination symlink and then change permissions on the linked target.
What can be done if updating is not immediately possible?
Do not extract with overwrite enabled into directories where untrusted users or processes can create entries. Use a newly created, access-controlled extraction directory and ensure no pre-existing symbolic links are present in destination path components.
How can I assess whether an extraction workflow is exposed?
Review uses of adm-zip 0.5.9 through 0.6.0 for overwrite-enabled calls to the affected extraction APIs. Prioritize workflows that use shared, reused, or predictable temporary directories or continuous-integration workspaces, where another actor can place symlinks before extraction.