Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 8

Export CSV
CVE-2026-116137

adm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent Names

adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries() check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP archives where getEntry() or readAsText() validates benign content while extractAllTo() writes malicious content to the same path, bypassing integrity checks.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Adm-zip Project Cthackers
Products
Adm-zip Adm-zip
CVE-2026-114104

adm-zip before 0.6.1 Duplicate ZIP Entry Name Validation Bypass

adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry names. Attackers can craft archives where getEntry() returns the last duplicate while extractAllTo() writes the first, causing unvalidated bytes to be written to disk.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Adm-zip Project
Products
Adm-zip
CVE-2026-114103

adm-zip 0.6.0 Decompression Bomb Guard Bypass via getDataAsync()

adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync() path in methods/inflater.js. Attackers can craft ZIP entries with falsified small declared sizes and high-ratio DEFLATE payloads to exhaust memory in applications reading entries asynchronously.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Adm-zip Project Cthackers
Products
Adm-zip Adm-zip
CVE-2026-114102

adm-zip before 0.6.1 Denial of Service via inflateAsync Unhandled Error Event

adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.js lacks a zlib stream error listener. Attackers can supply a ZIP with corrupted DEFLATE data processed by readFileAsync, readAsTextAsync, extractAllToAsync, or getDataAsync, triggering an uncatchable exception that terminates all in-flight requests.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Adm-zip Project Cthackers
Products
Adm-zip Adm-zip
CVE-2026-114105

Adm-zip before 0.6.1 Privilege Escalation via keepOriginalPermission Setuid Bits

Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setgid, or sticky bits on extracted files when keepOriginalPermission is enabled. Attackers can craft zip external file attributes that pass unmasked into chmod, letting attacker-controlled executables gain elevated privileges when extracted as root and later run.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Adm-zip Project Cthackers
Products
Adm-zip Adm-zip
CVE-2026-92000

adm-zip 0.5.14 through 0.6.0 Denial of Service via Zero Declared Uncompressed Size

adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attackers can craft malicious ZIP archives with highly compressible entries declaring zero size to exhaust memory and cause denial of service.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Adm-zip Project Cthackers
Products
Adm-zip Adm-zip
CVE-2026-76845

adm-zip 0.5.9 through 0.6.0 Arbitrary File Overwrite via Symlink Following on Extraction

adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforces containment by comparing only the string form of an archive entry name against the resolved extraction root, and Utils.writeFileTo opens the computed destination with fs.openSync(path, "w", 0o666), which resolves symbolic links and carries neither O_NOFOLLOW nor a pre-write fs.lstatSync check. When a path component at the destination already exists as a symbolic link pointing outside the extraction root, extractAllTo, extractAllToAsync and extractEntryTo write the entry contents through that link and then chmod its target, placing attacker-controlled content in a file outside the root without any traversal sequence appearing in the archive. Reaching the write requires overwrite to be enabled, because the preceding fs.existsSync check also resolves the link and otherwise declines. An attacker able to create a symbolic link inside a shared, reused or predictable extraction directory, such as a temporary directory or a continuous integration workspace, can overwrite any file the extracting process is permitted to write.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Adm-zip Project Cthackers
Products
Adm-zip Adm-zip
CVE-2018-1002204

nodejs-adm-zip: arbitrary file write vulnerability / arbitrary code execution using a specially crafted zip file

adm-zip npm library before 0.4.9 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

CVSS 3.1 · 5.5 Medium EPSS 13.5% KEV · Not listed
Vendors
Adm-zip Project
Products
Adm-zip