adm-zip extraction follows destination symlinks, allowing arbitrary file overwrite

adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforces containment by comparing only the string form of an archive entry name against the resolved extraction root, and Utils.writeFileTo opens the computed destination with...

CVE-2026-76845

adm-zip versions 0.5.9 through 0.6.0 suffer from an arbitrary file overwrite via symbolic link following at the extraction destination. The root cause lies in Utils.sanitize (in util/utils.js), which compares only the string form of an archive entry name against the resolved extraction root, and ...