CVE-2026-76845 cthackers CVE debrief

Who should care

Defenders responsible for systems or applications using adm-zip for extraction, especially in shared or predictable extraction directories, should assess exposure and prioritize verification and patching.

Why it matters

CVE-2026-76845 allows for arbitrary file overwrite via symlink following in adm-zip versions 0.5.9 through 0.6.0. Defenders should verify and patch affected versions, especially in shared or predictable extraction directories, and monitor for potential exploitation attempts.

• Potential for arbitrary file overwrite in shared or predictable extraction directories
• Possible exploitation requires overwrite to be enabled and a symbolic link to be created
• Verification of affected versions and extraction directory configurations is necessary
• Remediation priority is moderate due to the requirement for specific conditions to be met

Technical summary

The adm-zip library versions 0.5.9 through 0.6.0 are vulnerable to symlink following during extraction, allowing for arbitrary file overwrite. This occurs because Utils.sanitize compares only the string form of an archive entry name against the resolved extraction root, and Utils.writeFileTo opens the computed destination with fs.openSync, which resolves symbolic links. The vulnerability allows for arbitrary file overwrite via symlink following in adm-zip versions 0.5.9 through 0.6.0. Defenders should prioritize verifying and patching adm-zip versions 0.5.9 through 0.6.0, especially in shared or predictable extraction directories.

Defensive priority

Defenders should prioritize verifying and patching adm-zip versions 0.5.9 through 0.6.0, especially in shared or predictable extraction directories.

Recommended defensive actions

• Verify and patch adm-zip versions 0.5.9 through 0.6.0
• Review extraction directories for shared or predictable paths
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in adm-zip. However, the scope of affected versions and potential impact require further verification. The vulnerability is caused by Utils.sanitize comparing only the string form of an archive entry name against the resolved extraction root, and Utils.writeFileTo opening the computed destination with fs.openSync, which resolves symbolic links. Defenders should verify and patch affected versions, especially in shared or predictable extraction directories, and monitor

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.