Technical impact
The adm‑zip library up to 0.6.1 performs duplicate‑entry checks during entry inspection but the extraction routine writes files based only on the entry name. An attacker can include entries with canonically equivalent names, such as “./hello.txt” and “hello.txt”. The library will consider only one entry during validation, while the extraction writes both, allowing malicious content to replace or overwrite files that were presumed safe. This results in integrity compromise and the potential insertion of malicious files while the application believes only benign content was processed.
Affected Systems
The issue affects the cthackers:adm‑zip package, specifically all releases v0.6.1 and earlier. Any Node.js application that imports this library and uses functions such as getEntry(), readAsText(), readEntries(), or extractAllTo() to process ZIP archives is vulnerable. The flaw does not require privileged execution and is exploitable against any deployment that accepts external ZIP files, including web services, file upload endpoints, or import utilities.
Risk and Exploitability
The CVSS score of 6.3 indicates a moderate severity vulnerability. EPSS is not available and the flaw is not listed in the CISA KEV catalog, suggesting current exploitation activity is low. The primary attack vector is the ingestion of a crafted ZIP archive from an untrusted source; only a basic validation check is performed before extraction, so the vulnerability can be exploited if the application uses extractAllTo after a duplicate entry check. Success does not require additional privileges, but it can lead to persistent malicious files being written to the file system.
