Inconsistent Entry Resolution in adm-zip Library

Executive Summary

CVE-2026-114104 is an inconsistent entry resolution vulnerability in the adm-zip library before version 0.6.1. It occurs when ZIP archives contain duplicate entry names. The getEntry() function returns the last duplicate entry while extractAllTo() writes the first one, causing unvalidated bytes to be written to disk despite passing validation checks.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect applications using adm-zip versions 0.6.0 or earlier. Check for ZIP archives with duplicate entry names in your system or network traffic. Use commands like 'npm list adm-zip' to verify installed versions and 'find / -name "*.zip" -exec unzip -l {} \;' to scan for duplicate entries in ZIP files.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to bypass content validation by crafting ZIP files with duplicate entry names. Applications using adm-zip may approve untrusted content based on validation checks but extract different, potentially malicious content to disk. This could lead to arbitrary file writes or execution of unvalidated code.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate integrity requirements in GDPR and HIPAA by allowing unauthorized file writes. Applications processing ZIP files may fail to ensure data integrity, potentially leading to unauthorized data access or modification. Compliance may be impacted if the affected library is used in systems handling sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update adm-zip to version 0.6.1 or later using 'npm update adm-zip'. If updating is not possible, implement strict input validation for ZIP files to reject archives with duplicate entry names. Monitor for suspicious ZIP file processing in your applications.

Useful 0 Not Useful 0