CVE-2026-114104 Details
Description
adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry names. Attackers can craft archives where getEntry() returns the last duplicate while extractAllTo() writes the first, causing unvalidated bytes to be written to disk.
A vulnerability exists in adm-zip versions prior to 0.6.1, allowing attackers to bypass content validation by creating ZIP archives with duplicate entry names. The library's handling of these duplicates can lead to a scenario where unvalidated data is extracted to disk. Specifically, while the getEntry() method retrieves the last duplicate entry, the extractAllTo() method writes the first duplicate's content, creating a mismatch that can be exploited.
Users are advised to update adm-zip to version 0.6.1 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/cthackers/adm-zip/security/advisories/GHSA-p634-w6r4-rjp2 | CISA-ADP | AdvisoryExploitTechnical DescriptionVendor |
| https://github.com/cthackers/adm-zip/security/advisories/GHSA-p634-w6r4-rjp2 | [email protected] | AdvisoryExploitTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/adm-zip-before-0.6.1-duplicate-zip-entry-name-validation-bypass | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-436 | Interpretation Conflict | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| adm-zip | <= 0.6.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 21, 2026 | New CVE Received | [email protected] |