15 matches found
CVE-2026-114104
The adm-zip library before version 0.6.1 is vulnerable to an inconsistent entry resolution flaw. Attackers can bypass content validation by providing ZIP archives containing duplicate entry names . Specifically, the library's getEntry() method may return the last duplicate entry while the extract...
EUVD-2026-106907
adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry names. Attackers can craft archives where getEntry returns the last duplicate while extractAllTo writes the first, causing...
CVE-2026-102282
adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via fs.chmodSync when keepOriginalPermission=true is passed to extractAllTo/extractEntryTo — and it...
EUVD-2026-92493
adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via fs.chmodSync when keepOriginalPermission=true is passed to extractAllTo/extractEntryTo — and it...
Adm-zip Privilege Escalation
The vulnerability of the extractAllTo and extractEntryTo functions in the Node.js library for working with zip files, Adm-zip, is related to the improper assignment of permissions for critical resources. Exploiting this vulnerability can allow an attacker to increase their privileges...
adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content
Summary A ZIP file can contain two entries with the identical name. adm-zip keeps both in its internal entry list, but its name-lookup table only retains the last one written. getEntryname and extractAllTo walk these two different internal structures, so they can each resolve a duplicate name to ...
NPM: adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content
NPM: adm-zip: Duplicate ZIP entry names: getEntry and extractAllTo resolve to different content vulnerability discovered by ? in WordPress Npm adm-zip versions = 0.6.0...
GHSA-P634-W6R4-RJP2 adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content
Summary A ZIP file can contain two entries with the identical name. adm-zip keeps both in its internal entry list, but its name-lookup table only retains the last one written. getEntryname and extractAllTo walk these two different internal structures, so they can each resolve a duplicate name to ...
Incorrect Behavior Order
Overview adm-zip is a JavaScript implementation for zip data compression for NodeJS. Affected versions of this package are vulnerable to Incorrect Behavior Order via duplicate entry names in a ZIP archive processed by zipFile.js. Because adm-zip stores all entries in entryList used by extractAllT...
PT-2026-102974
Name of the Vulnerable Software and Affected Versions adm-zip version 0.6.0 Description An issue exists where the software applies Unix permission bits from a zip entry directly to an extracted file using the fs.chmodSync function when the keepOriginalPermission flag is set to true in the...
Symlink Attack
Overview org.webjars.npm:adm-zip is a JavaScript implementation for zip data compression for NodeJS. Affected versions of this package are vulnerable to Symlink Attack through the extractAllTo, extractAllToAsync, and extractEntryTo code paths in util/utils.js. An attacker can write...
Symlink Attack
Overview adm-zip is a JavaScript implementation for zip data compression for NodeJS. Affected versions of this package are vulnerable to Symlink Attack through the extractAllTo, extractAllToAsync, and extractEntryTo code paths in util/utils.js. An attacker can write attacker-controlled contents...
CVE-2026-76845
adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforces containment by comparing only the string form of an archive entry name against the resolved extraction root, and Utils.writeFileTo opens the computed destination with...
CVE-2026-76845: Improper Link Resolution Before File Access
adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforces containment by comparing only the string form of an archive entry name against the resolved extraction root, and Utils.writeFileTo opens the computed destination with...
