Symlink Attack

Overview adm-zip is a JavaScript implementation for zip data compression for NodeJS. Affected versions of this package are vulnerable to Symlink Attack through the extractAllTo, extractAllToAsync, and extractEntryTo code paths in util/utils.js. An attacker can write attacker-controlled contents...

Directory Traversal

adm-zip is vulnerable to directory traversal. The vulnerability exists due to the function extractAllTo allowing the extractions of files to a different folder...