The vulnerability in adm-zip 0.5.9 through 0.6.0 involves improper link resolution before file access during archive extraction. The utility function Utils.sanitize enforces containment by comparing only the string form of archive entry names against the extraction root path, which does not prevent symbolic links from pointing outside the root. The write operation uses fs.openSync without the O_NOFOLLOW flag and without a pre-write lstat check, allowing symbolic links to be followed. If a symbolic link exists at the destination path pointing outside the extraction root, extractAllTo and related functions will write attacker-controlled content to files outside the intended directory. This requires overwrite to be enabled, as the existence check also resolves the link and otherwise prevents writing. An attacker able to create symbolic links in shared or predictable extraction directories can exploit this to overwrite arbitrary files writable by the extracting process.

An attacker with the ability to create symbolic links in a shared, reused, or predictable extraction directory can cause arbitrary files outside the extraction root to be overwritten during archive extraction. This can lead to unauthorized modification of files that the extracting process has write permissions for, potentially compromising system integrity or application behavior. The vulnerability requires local access to create symbolic links and overwrite enabled during extraction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid extracting archives with overwrite enabled in shared or predictable directories where an attacker could place symbolic links. Restrict permissions to prevent unauthorized creation of symbolic links in extraction directories. Monitor vendor communications for official patches or updates addressing this issue.