CVE-2026-76845 Overview
CVE-2026-76845 is a symbolic link following vulnerability in the adm-zip Node.js library, versions 0.5.9 through 0.6.0. The library extracts ZIP archive contents through pre-existing symbolic links at the destination path, writing attacker-controlled data outside the intended extraction root. The flaw resides in Utils.sanitize and Utils.writeFileTo in util/utils.js, which fail to detect symlinks before opening destination files. Exploitation requires the overwrite option to be enabled and an attacker able to plant a symlink inside a shared or predictable extraction directory. The issue is tracked as CWE-59: Link Following.
Critical Impact
Attackers with local write access to a reused extraction directory can overwrite arbitrary files writable by the extracting process, compromising integrity of application, configuration, or CI/CD artifacts.
Affected Products
- adm-zip version 0.5.9
- adm-zip versions between 0.5.9 and 0.6.0
- adm-zip version 0.6.0
Discovery Timeline
- 2026-08-24 - CVE-2026-76845 published to NVD
- 2026-08-24 - Last updated in NVD database
Technical Details for CVE-2026-76845
Vulnerability Analysis
The adm-zip library extracts ZIP archives using three entry points: extractAllTo, extractAllToAsync, and extractEntryTo. Each writes archive entries through Utils.writeFileTo, which calls fs.openSync(path, "w", 0o666) to open the destination file. This system call resolves symbolic links along the path. The library omits both the O_NOFOLLOW flag and any preceding fs.lstatSync check to detect a symlink at the target.
When a path component at the destination already exists as a symlink pointing outside the extraction root, the library writes the entry contents through that link. It then invokes chmod on the resolved target. This places attacker-controlled content in a file outside the extraction root without any traversal sequence appearing in the archive itself.
Root Cause
Containment enforcement in Utils.sanitize compares only the string form of the archive entry name against the resolved extraction root. This string comparison does not account for filesystem-level indirection introduced by symbolic links. Because fs.existsSync also resolves the link, reaching the vulnerable write path requires the caller to pass the overwrite flag; otherwise the existence check declines the write.
Attack Vector
The attack requires local access to a directory where adm-zip will extract an archive. Suitable locations include temporary directories, continuous integration (CI) workspaces, or any shared, reused, or predictable extraction path. The attacker plants a symlink at a filename that the archive will emit, pointing to a sensitive file such as an SSH key, a systemd unit, or a build artifact. When extraction runs with overwrite enabled, adm-zip follows the symlink and writes the archive entry contents into the target file. The vulnerability requires no traversal characters in the archive and no elevated privileges beyond the extracting process's own write permissions.
The vulnerability mechanism is documented in the VulnCheck Advisory on adm-zip and the adm-zip source at util/utils.js.
Detection Methods for CVE-2026-76845
Indicators of Compromise
- Unexpected symbolic links inside temporary or CI workspace directories immediately before an adm-zip extraction operation.
- File modifications on sensitive paths whose parent directory contains a symlink pointing outside the extraction root.
- Node.js process activity showing fs.openSync writes to paths that resolve outside the declared extraction directory.
Detection Strategies
- Perform a software composition analysis (SCA) scan of Node.js projects for adm-zip versions 0.5.9 through 0.6.0.
- Audit application code for calls to extractAllTo, extractAllToAsync, and extractEntryTo with overwrite=true.
- Instrument extraction workflows with an fs.lstatSync check on each destination path and alert on symlink detection.
Monitoring Recommendations
- Monitor filesystem telemetry for symlink creation events in extraction directories used by CI runners and build agents.
- Alert on writes by Node.js processes to files outside their declared working directory or workspace root.
- Log and review the overwrite flag usage in all adm-zip extraction calls across production pipelines.
How to Mitigate CVE-2026-76845
Immediate Actions Required
- Inventory all Node.js applications and CI pipelines that depend on adm-zip and identify versions 0.5.9 through 0.6.0.
- Disable the overwrite option in extraction calls where it is not strictly required, blocking the vulnerable write path.
- Ensure extraction destinations are freshly created directories with no pre-existing entries or symlinks.
Patch Information
At the time of NVD publication, refer to the adm-zip GitHub repository for the latest release status and any post-0.6.0 fix. Consumers should track upstream commits to util/utils.js for the addition of O_NOFOLLOW semantics or a pre-write fs.lstatSync check.
Workarounds
- Extract archives into a unique per-invocation temporary directory created with restrictive permissions such as mode 0o700.
- Wrap adm-zip calls with a pre-extraction routine that runs fs.lstatSync on each target path and aborts if any component is a symbolic link.
- Run extraction under a dedicated low-privilege user account that cannot write to sensitive system or application files.
# Configuration example: run extraction in an isolated temp directory
mkdir -p /tmp/extract-$$ && chmod 700 /tmp/extract-$$
node -e "require('adm-zip')('archive.zip').extractAllTo('/tmp/extract-'+process.pid, false)"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
