Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| adm-zip | npm | >= 0.5.9, <= 0.6.0 |
Miggo AIRoot Cause AnalysisThe vulnerability CVE-2026-76845 in adm-zip versions 0.5.9 through 0.6.0 allows for arbitrary file overwrite due to improper handling of symbolic links during archive extraction. The core issue lies in how the library's internal utility functions, specifically Utils.makeDir, Utils.writeFileTo, and Utils.writeFileToAsync, interact with the filesystem. These functions previously used Node.js fs.statSync, fs.existsSync, and fs.open (or their asynchronous counterparts) without adequate checks for symbolic links or the O_NOFOLLOW flag.
When an attacker could create a symbolic link within the extraction destination that pointed outside the intended root directory, these functions would resolve the symlink and operate on the target file or directory. This allowed an attacker to overwrite arbitrary files on the system (if overwrite was enabled during extraction) or create directories outside the intended path.
The provided patch addresses this by:
lstatSync (and lstat for async operations), which provides information about the file itself, not the file it refers to if it's a symbolic link.Utils.makeDir, Utils.writeFileTo, and Utils.writeFileToAsync to traverse path components and verify that none of them are symbolic links. If a symbolic link is found, an error is thrown, preventing the malicious operation.Therefore, the identified vulnerable functions are those that directly performed file system operations without these crucial symlink checks, allowing the exploitation to occur.