CVE-2026-114104
adm-zip before 0.6.1 Duplicate ZIP Entry Name Validation Bypass
- State
- Published
- Severity
- 8.2 High
- Published
- Oct 21, 2026
- Updated
- Oct 28, 2026
- Reserved
- Oct 20, 2026
Description
adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry names. Attackers can craft archives where getEntry() returns the last duplicate while extractAllTo() writes the first, causing unvalidated bytes to be written to disk.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.2 High | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.9 Medium | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N | VulnCheck |
Weaknesses
- CWE-436 Interpretation Conflict
Affected Products
| Product | Versions |
|---|---|
adm-zipcthackers |
|
References
- GitHub Security Advisory (GHSA-p634-w6r4-rjp2)vendor-advisory
- VulnCheck Advisory: adm-zip before 0.6.1 Duplicate ZIP Entry Name Validation Bypassthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.