adm-zip extraction follows destination symlinks, allowing arbitrary file overwrite

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS 4.0

6.8 · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N · score source

EPSS

• CVE-2026-76845: 0.17% estimated exploitation activity in the next 30 days; percentile 6.48 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforces containment by comparing only the string form of an archive entry name against the resolved extraction root, and Utils.writeFileTo opens the computed destination with fs.openSync(path, "w", 0o666), which resolves symbolic links and carries neither ONOFOLLOW nor a pre-write fs.lstatSync check. When a path component at the destination already exists as a symbolic link pointing outside the extraction root, extractAllTo, extractAllToAsync and extractEntryTo write the entry contents through that link and then chmod its target, placing attacker-controlled content in a file outside the root without any traversal sequence appearing in the archive. Reaching the write requires overwrite to be enabled, because the preceding fs.existsSync check also resolves the link and otherwise declines. An attacker able to create a symbolic link inside a shared, reused or predictable…

Published by the source

24 Aug 2026, 15:31 UTC

Last modified by the source

8 Sep 2026, 21:20 UTC

Source last checked

26 Oct 2026, 13:02 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-vwc7-r8mq-g2x9

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-76845

Advisory: adm-zip extraction follows destination symlinks, allowing arbitrary file overwrite
IDs: CVE-2026-76845, GHSA-vwc7-r8mq-g2x9
Record: https://patchnext.com/advisories/cve-2026-76845 (revision 1, source checked 26 Oct 2026, 13:02 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 6.8)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor response not established. A vendor fix does not mean a deployment is fixed.

## Affected components
- npm adm-zip: affected >= 0.5.9, <= 0.6.0

## Suggested inspection (read-only)
- `npm ls adm-zip --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.

## Supported action
No complete vendor fix is recorded. Follow the primary source's mitigation guidance and check this record again before closing anything.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on adm-zip.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-vwc7-r8mq-g2x9 (GitHub-reviewed advisory GHSA-vwc7-r8mq-g2x9 lists affected ranges: npm adm-zip >=0.5.9 <=0.6.0)

Commands are suggestions: review each one before running it.