The adm-zip.js:extractAllTo and adm-zip.js:extractEntryTo methods do not sanitize zip entry filenames allowing files to be extracted outside of the targetPath argument directory.
These functions use path.resolve to combine the targetPath argument with the zip entry entryName without checking or sanitizing the result. If a zip file contains a filename with an absolute path, e.g. /tmp/outfile, or a relative path with parent directory specifiers, e.g. ../outfile, these entries will be extracted outside the specified targetPath directory.
Both extractAllTo and extractEntryTo should check that the result of path.resolve is under the targetPath directory and discard or sanitise any paths that do not pass this check.
The
adm-zip.js:extractAllToandadm-zip.js:extractEntryTomethods do not sanitize zip entry filenames allowing files to be extracted outside of thetargetPathargument directory.These functions use
path.resolveto combine thetargetPathargument with the zip entryentryNamewithout checking or sanitizing the result. If a zip file contains a filename with an absolute path, e.g./tmp/outfile, or a relative path with parent directory specifiers, e.g.../outfile, these entries will be extracted outside the specifiedtargetPathdirectory.Both
extractAllToandextractEntryToshould check that the result ofpath.resolveis under thetargetPathdirectory and discard or sanitise any paths that do not pass this check.