Arbitrary File Overwrite in adm-zip by cthackers

CVE-2026-76845

What is CVE-2026-76845?

The adm-zip library versions 0.5.9 through 0.6.0 contain a vulnerability that allows for arbitrary file overwrites via symbolic link following during the extraction process. The issue arises because the library fails to restrict access adequately when extracting files. Specifically, it permits symbolic links to be followed, enabling an attacker who can create such links in a writable extraction directory to corrupt files outside of the intended extraction root. Consequently, when a file exists as a symbolic link directing to a location outside the intended directory, the library can unintentionally overwrite critical files with attacker-controlled content, leading to potentially serious security implications.

References