13 matches found
CVE-2026-102282
adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via fs.chmodSync when keepOriginalPermission=true is passed to extractAllTo/extractEntryTo — and it...
EUVD-2026-92493
adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via fs.chmodSync when keepOriginalPermission=true is passed to extractAllTo/extractEntryTo — and it...
The vulnerabilities of the `extractAllTo()` and `extractEntryTo()` functions in the Node.js library for working with zip files, Adm-zip, allow attackers to escalate their privileges.
The vulnerability of the extractAllTo and extractEntryTo functions in the Node.js library for working with zip files, Adm-zip, is related to the improper assignment of permissions for critical resources. Exploiting this vulnerability can allow an attacker to increase their privileges...
GHSA-P634-W6R4-RJP2 adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content
Summary A ZIP file can contain two entries with the identical name. adm-zip keeps both in its internal entry list, but its name-lookup table only retains the last one written. getEntryname and extractAllTo walk these two different internal structures, so they can each resolve a duplicate name to ...
NPM: adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content
NPM: adm-zip: Duplicate ZIP entry names: getEntry and extractAllTo resolve to different content vulnerability discovered by ? in WordPress Npm adm-zip versions = 0.6.0...
adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content
Summary A ZIP file can contain two entries with the identical name. adm-zip keeps both in its internal entry list, but its name-lookup table only retains the last one written. getEntryname and extractAllTo walk these two different internal structures, so they can each resolve a duplicate name to ...
Incorrect Behavior Order
Overview adm-zip is a JavaScript implementation for zip data compression for NodeJS. Affected versions of this package are vulnerable to Incorrect Behavior Order via duplicate entry names in a ZIP archive processed by zipFile.js. Because adm-zip stores all entries in entryList used by extractAllT...
PT-2026-102974
Name of the Vulnerable Software and Affected Versions adm-zip version 0.6.0 Description An issue exists where the software applies Unix permission bits from a zip entry directly to an extracted file using the fs.chmodSync function when the keepOriginalPermission flag is set to true in the...
Symlink Attack
Overview org.webjars.npm:adm-zip is a JavaScript implementation for zip data compression for NodeJS. Affected versions of this package are vulnerable to Symlink Attack through the extractAllTo, extractAllToAsync, and extractEntryTo code paths in util/utils.js. An attacker can write...
Symlink Attack
Overview adm-zip is a JavaScript implementation for zip data compression for NodeJS. Affected versions of this package are vulnerable to Symlink Attack through the extractAllTo, extractAllToAsync, and extractEntryTo code paths in util/utils.js. An attacker can write attacker-controlled contents...
CVE-2026-76845
adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforces containment by comparing only the string form of an archive entry name against the resolved extraction root, and Utils.writeFileTo opens the computed destination with...
CVE-2026-76845: Improper Link Resolution Before File Access
adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforces containment by comparing only the string form of an archive entry name against the resolved extraction root, and Utils.writeFileTo opens the computed destination with...
