CVE-2026-76845

adm-zip 0.5.9 through 0.6.0 Arbitrary File Overwrite via Symlink Following on Extraction

Published Aug 24, 2026 CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Description

adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforces containment by comparing only the string form of an archive entry name against the resolved extraction root, and Utils.writeFileTo opens the computed destination with fs.openSync(path, "w", 0o666), which resolves symbolic links and carries neither O_NOFOLLOW nor a pre-write fs.lstatSync check. When a path component at the destination already exists as a symbolic link pointing outside the extraction root, extractAllTo, extractAllToAsync and extractEntryTo write the entry contents through that link and then chmod its target, placing attacker-controlled content in a file outside the root without any traversal sequence appearing in the archive. Reaching the write requires overwrite to be enabled, because the preceding fs.existsSync check also resolves the link and otherwise declines. An attacker able to create a symbolic link inside a shared, reused or predictable extraction directory, such as a temporary directory or a continuous integration workspace, can overwrite any file the extracting process is permitted to write.

Analysis

Technical impact

Adm-zip versions 0.5.9 through 0.6.0 follow symbolic links when extracting archives. The utility sanitizes file names by comparing string representations rather than resolving links, and writes data to paths resolved by the operating system without the O_NOFOLLOW flag. If a component of the extraction destination is already a symbolic link that points outside the intended root, extraction will write through that link, overwriting the target file and then changing its permissions. This flaw allows an attacker to replace any file the extracting process can write to, without any traversal characters in the archive itself.

Affected Systems

The issue affects the adm-zip project released by cthackers, specifically the 0.5.9, 0.5.10, 0.5.11, and 0.6.0 releases. Any deployment that relies on those versions for archive extraction is vulnerable.

Risk and Exploitability

The CVSS score of 6.8 indicates moderate severity. The EPSS score is not provided and the vulnerability is not listed in the CISA KEV catalog, suggesting no known large‐scale exploitation currently. However, the flaw can be leveraged by an attacker who can place a symbolic link in the extraction directory—e.g., in a shared temporary folder, a repeatable CI workspace, or any directory the process writes to—thereby enabling the attacker to overwrite arbitrary files like configuration files or executables. The exploit requires local write access to the extraction path and any privileges the extraction process runs with.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

cthackers

adm-zip

unaffected

Version	Status	Constraints
`0.5.9`	affected	≤ 0.6.0

No data.

Vendor Product Versions

Adm-zip Project

Adm-zip

Version	Status	Scheme	Platform
`[0,*]`	affected	generic	—

Cthackers

Adm-zip

Version	Status	Scheme	Platform
`[0.5.9,0.6.0]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade adm-zip to a fixed version if one is available
If upgrade is not possible, disable the overwrite option or avoid setting overwrite to true during extraction
Ensure the extraction directory is owned by a trusted user and is not writable by untrusted users or shared across sessions
If feasible, modify the extraction logic to use O_NOFOLLOW or perform a pre‑write lstat check to detect symlinks before writing

Generated by OpenCVE AI on August 24, 2026 at 17:15 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-vwc7-r8mq-g2x9	adm-zip extraction follows destination symlinks, allowing arbitrary file overwrite

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.171% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/cthackers/adm-zip
https://github.com/cthackers/adm-zip/blob/v0.6.0/util/utils.js
https://nvd.nist.gov/vuln/detail/CVE-2026-76845
https://www.cve.org/CVERecord?id=CVE-2026-76845
https://www.vulncheck.com/advisories/adm-zip-through-arbitrary-file-overwrite-via-symlink-following-on-extraction

History

Aug 27, 2026 6:00 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-76845 https://www.cve.org/CVERecord?id=CVE-2026-76845
Metrics	threat_severity `None`	threat_severity `Moderate`

Aug 26, 2026 7:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 24, 2026 9:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Cthackers Cthackers adm-zip
Vendors & Products		Cthackers Cthackers adm-zip

Aug 24, 2026 1:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforces containment by comparing only the string form of an archive entry name against the resolved extraction root, and Utils.writeFileTo opens the computed destination with fs.openSync(path, "w", 0o666), which resolves symbolic links and carries neither O_NOFOLLOW nor a pre-write fs.lstatSync check. When a path component at the destination already exists as a symbolic link pointing outside the extraction root, extractAllTo, extractAllToAsync and extractEntryTo write the entry contents through that link and then chmod its target, placing attacker-controlled content in a file outside the root without any traversal sequence appearing in the archive. Reaching the write requires overwrite to be enabled, because the preceding fs.existsSync check also resolves the link and otherwise declines. An attacker able to create a symbolic link inside a shared, reused or predictable extraction directory, such as a temporary directory or a continuous integration workspace, can overwrite any file the extracting process is permitted to write.
Title		adm-zip 0.5.9 through 0.6.0 Arbitrary File Overwrite via Symlink Following on Extraction
First Time appeared		Adm-zip Project Adm-zip Project adm-zip
Weaknesses		CWE-59
CPEs		cpe:2.3:a:adm-zip_project:adm-zip::::::::
Vendors & Products		Adm-zip Project Adm-zip Project adm-zip
References		https://github.com/cthackers/adm-zip https://github.com/cthackers/adm-zip/blob/v0.6.0/util/utils.js https://www.vulncheck.com/advisories/adm-zip-through-arbitrary-file-overwrite-via-symlink-following-on-extraction
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N'}` cvssV4_0 `{'score': 6.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N'}`