CVE-2026-76845
Received Received - Intake

Symbolic Link Following in adm-zip Archive Extraction

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: VulnCheck

Description
adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforces containment by comparing only the string form of an archive entry name against the resolved extraction root, and Utils.writeFileTo opens the computed destination with fs.openSync(path, "w", 0o666), which resolves symbolic links and carries neither O_NOFOLLOW nor a pre-write fs.lstatSync check. When a path component at the destination already exists as a symbolic link pointing outside the extraction root, extractAllTo, extractAllToAsync and extractEntryTo write the entry contents through that link and then chmod its target, placing attacker-controlled content in a file outside the root without any traversal sequence appearing in the archive. Reaching the write requires overwrite to be enabled, because the preceding fs.existsSync check also resolves the link and otherwise declines. An attacker able to create a symbolic link inside a shared, reused or predictable extraction directory, such as a temporary directory or a continuous integration workspace, can overwrite any file the extracting process is permitted to write.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-76845
EUVD
EUVD-2026-64851

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
adm-zip adm-zip From 0.5.9 (inc) to 0.6.0 (inc)
cthackers adm-zip From 0.5.9 (inc) to 0.6.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in adm-zip versions 0.5.9 through 0.6.0 allows arbitrary file overwrite via symlink following during extraction. The library follows symbolic links at the extraction destination without proper containment checks. Attackers can exploit this by creating a symlink in a shared or predictable location, such as a temporary or CI workspace, to write attacker-controlled content to arbitrary files the process has permission to modify.

Detection Guidance

Check if adm-zip versions 0.5.9 through 0.6.0 are installed using npm list adm-zip or npm list -g adm-zip. Verify if your application extracts ZIP files from untrusted sources into directories where symlinks could be created. Monitor for unexpected file modifications outside intended extraction paths.

Impact Analysis

This vulnerability can allow attackers to overwrite critical system files, configuration files, or sensitive data by exploiting symlinks. If you use adm-zip in environments with shared or predictable extraction directories, an attacker could place malicious files outside the intended extraction directory, potentially leading to system compromise, data corruption, or unauthorized access.

Compliance Impact

This vulnerability could lead to unauthorized file overwrites outside intended directories, potentially exposing or modifying sensitive data. For GDPR, this may violate integrity and confidentiality principles (Article 5) if personal data is altered or accessed improperly. For HIPAA, it risks unauthorized access to protected health information if files containing such data are overwritten or exposed.

Mitigation Strategies

Upgrade adm-zip to a patched version if available. Disable overwrite options during extraction. Avoid extracting ZIP files from untrusted sources into directories with write permissions. Implement strict input validation for archive contents.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76845. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart