CVE-2026-76845: Improper Link Resolution Before File Access ('Link Following') in cthackers adm-zip

The adm-zip library versions 0.5.9 to 0.6.0 improperly handle symbolic links during archive extraction. The utility function Utils.sanitize compares only the string form of archive entry names against the extraction root, failing to prevent symbolic link traversal. The extraction functions (extractAllTo, extractAllToAsync, extractEntryTo) open destination files with fs.openSync without using O_NOFOLLOW or pre-write lstat checks, allowing writes through symbolic links pointing outside the extraction root. This enables an attacker who can create symbolic links in the extraction directory to overwrite arbitrary files that the extracting process can write to, provided overwrite is enabled.

An attacker able to create symbolic links in a shared, reused, or predictable extraction directory can cause the extraction process to overwrite arbitrary files outside the intended extraction root. This can lead to unauthorized file modification or replacement, potentially compromising system integrity or security. The attack requires local write permissions to the extraction directory and the ability to enable overwrite during extraction.

No explicit patch or fix is stated in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid extracting untrusted archives in shared or predictable directories where symbolic links can be created. Disable overwrite during extraction if possible and validate extraction paths with proper symbolic link resolution checks.