CVE-2026-116137
adm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent Names
cthackers adm-zip
CVSS
6.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries() check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP archives where getEntry() or readAsText() validates benign content while extractAllTo() writes malicious content to the same path, bypassing integrity checks.
Text from CVE List
Affected versions 1
- adm-zipaffected: all versions through 0.6.1CVE List
References 6
- vulncheck.com/advisories/adm-zip-through-0.6.1-duplicate-entry-validation-bypass-via-canonically-equivalent-namesAdvisoryvia CVE List
- github.com/cthackers/adm-zip/issues/587Referencevia CVE List
- github.com/cthackers/adm-zipReferencevia CVE List
- github.com/cthackers/adm-zip/blob/cb2cf9ba4c7c865db426e2de1997cb41194d9872/zipFile.js#L81-L92Referencevia CVE List
- github.com/cthackers/adm-zip/blob/cb2cf9ba4c7c865db426e2de1997cb41194d9872/adm-zip.js#L87Referencevia CVE List
- github.com/cthackers/adm-zip/blob/cb2cf9ba4c7c865db426e2de1997cb41194d9872/util/utils.js#L383Referencevia CVE List