Executive brief
zip-lib is a Node.js library used for compressing and extracting zip files. A security flaw in how it handles directory shortcuts (symlinks) allows an attacker to trick the library into writing or reading files outside of the intended folder. This could lead to the exposure of sensitive system files or unauthorized data access if an application processes untrusted zip archives.
Technical details
A directory traversal vulnerability exists in zip-lib versions prior to 1.1.0. The root cause is found in the `isOutsideTargetFolder` function, which caches path validation status only when a directory symlink is initially created. An attacker can exploit this by providing multiple zip files: the first creates a symlink pointing to an external directory (e.g., /tmp/), and subsequent extractions use that cached path to write files into the external location, bypassing the intended folder restrictions. This allows for arbitrary file writes or information disclosure depending on the application's implementation. The issue is fixed in version 1.1.0 by improving how symbolic links and realpaths are handled during folder validation.
Affected products
- fpsqdb zip-lib < 1.1.0
Timeline
- 2025-04-05: disclosed: Vulnerability reported via GitHub issue
- 2025-04-06: patched: Fix committed to repository
- 2026-07-28: advisory: CVE published and Snyk advisory released