adm-zip CVE-2026-76845

Two conditions must both be satisfied. First, the calling application must pass overwrite: true (or the equivalent truthy flag) to extractAllTo, extractAllToAsync, or extractEntryTo - without this flag the fs.existsSync pre-check resolves the symlink and refuses to overwrite, blocking the write. Second, the attacker must be able to create a symbolic link at a path component inside the extraction root before extraction begins - this requires filesystem write access to the extraction directory or a parent, which is achievable in shared temporary directories, multi-tenant CI workspaces, or any directory with group/world write bits. Exploitation is limited to files the extracting process has permission to write; it does not grant write access beyond the OS-enforced privilege boundary of the extracting user. The vulnerability is not exploitable through the archive entry path alone (no traversal sequence in the entry name) - the symlink must pre-exist at the destination on the host filesystem.

The CVSS 4.0 score of 6.8 (AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N) reflects the local-only attack vector and the absence of a confidentiality impact, while correctly flagging high integrity impact. The tag 'Information Disclosure' from VulnCheck appears to be a mislabeling - the actual primitive is arbitrary file write, not read. The overwrite=true flag is a hard prerequisite; this is a non-default caller configuration that significantly narrows real-world exposure compared to the raw vector suggests. The AT:N assignment in the provided CVSS 4.0 vector may understate the deployment-specific condition (overwrite must be explicitly enabled), which in CVSS 3.1 terms would drive AC to H. No EPSS data was supplied. The vulnerability is not in CISA KEV and no POC is confirmed. Real-world priority is elevated for applications that (a) extract ZIP archives to shared or predictable directories such as /tmp or CI workspace paths and (b) invoke extraction with overwrite enabled - a pattern common in build tools, artifact deployers, and archive managers. Applications extracting to fresh, process-owned directories with overwrite disabled are not exploitable.

An attacker with write access to a shared CI workspace directory creates a symbolic link at a predictable sub-path - for example, workspace/dist/config pointing to /etc/cron.d/pwned - before a build job runs. When the CI job calls extractAllTo('workspace/dist', true) on an attacker-influenced archive containing an entry named config, adm-zip resolves the destination through the symlink and writes the archive entry's contents to /etc/cron.d/pwned, then chmods it, granting the attacker a cron execution primitive under the CI agent's privileges. No path-traversal characters appear in the archive entry name, so the sanitize check passes cleanly.