CVE-2026-116137
Deferred Deferred - Pending Action

Duplicate-Entry Validation Bypass in adm-zip

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: VulnCheck

Description
adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries() check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP archives where getEntry() or readAsText() validates benign content while extractAllTo() writes malicious content to the same path, bypassing integrity checks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-116137
EUVD
EUVD-2026-109389

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cthackers adm-zip 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-436 Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in adm-zip through 0.6.1 allows attackers to bypass duplicate-entry checks by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. The readEntries() check is evaded, but extractAllTo() writes malicious content to the same path, bypassing integrity checks.

Detection Guidance

To detect this vulnerability, inspect ZIP archives processed by adm-zip 0.6.1 or earlier for entries with canonically equivalent names like './hello.txt' and 'hello.txt'. Use tools like 'unzip -l archive.zip' to list entries and compare paths for normalization issues. Check for silent overwrites during extraction where only one file is written despite multiple entries.

Impact Analysis

Attackers can craft ZIP archives that pass validation checks but overwrite or create files in unintended locations during extraction. This could lead to file corruption, unauthorized file access, or execution of malicious code if the extracted files are later used by the application.

Mitigation Strategies

Upgrade adm-zip to a patched version beyond 0.6.1. If upgrading is not possible, avoid using adm-zip for untrusted ZIP files. Implement additional validation to detect and reject archives with duplicate normalized paths. Use alternative libraries like 'yauzl' or 'archiver' for ZIP operations until the issue is resolved.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116137. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart