Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: cthackers adm-zip 0.6.1 Clear all filters
TI-2026-78718 CVE-2026-114105

Privilege escalation in adm-zip via setuid bits on extracted files

Priority LOW 29

Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setgid, or sticky bits on extracted files when keepOriginalPermission is enabled.

CVSS 4.0MEDIUM 6.9 Local No auth No interaction EPSS 0.00136 Published 2026-10-21 Partial fix · 0.6.1 CWE-732
TI-2026-78717 CVE-2026-114104

Duplicate ZIP entry names bypass validation in adm-zip

Priority HIGH 69

adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry names.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00331 Published 2026-10-21 Partial fix · 0.6.1 CWE-436
TI-2026-78716 CVE-2026-114103

Decompression bomb guard bypass in adm-zip exhausts memory

Priority HIGH 70

adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync() path in methods/inflater.js.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00404 Published 2026-10-21 Partial fix · 0.6.1 CWE-400
TI-2026-78715 CVE-2026-114102

Denial of service in adm-zip via unhandled error in inflateAsync

Priority HIGH 77

adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.js lacks a zlib stream…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00455 Published 2026-10-21 Partial fix · 0.6.1 CWE-248