adm-zip before version 0.6.1 contains an inconsistent entry resolution flaw that allows attackers to supply ZIP archives with duplicate entry names. Based on the description, it is inferred that the library’s getEntry() method returns the last duplicate entry while extractAllTo() writes the first entry, enabling unvalidated bytes to be written to the host filesystem. The result is arbitrary file creation or overwrite, which could jeopardize application integrity or allow privilege escalation if the attacker can place executable files or overwrite critical configuration files.

The affected product is the Node.js ZIP handling library adm-zip, maintained by cthackers. The vulnerability exists in all releases through version 0.6.1 inclusive. Any Node.js application that imports adm-zip and processes external ZIP archives may be impacted.

The CVSS score of 8.2 indicates high severity, while the EPSS score of less than 1 % suggests that public exploitation is currently rare. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a crafted ZIP archive to an application that uses getEntry() followed by extractAllTo(), which can occur via file uploads or remote API calls. If exploited, the attacker could create or overwrite files, potentially leading to arbitrary code execution if executable files are written to a path that is subsequently executed by the system.