CVE-2026-114104: adm-zip before 0.6.1 Duplicate ZIP Entry Name Validation Bypass
adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry names. Attackers can craft archives where getEntry() returns the last duplicate while extractAllTo() writes the first, causing unvalidated bytes to be written to disk.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using npm/adm-zip before 0.6.1 are exposed if they validate archive content using getEntry() and then extract the same attacker-controlled archive with extractAllTo(). The issue depends on processing ZIP archives supplied by an attacker or other untrusted source.
What does an attacker need to exploit it?
An attacker needs to provide a crafted ZIP archive containing duplicate entry names. They do not need privileges or user interaction, but exploitation has high attack complexity.
How can this affect validation logic?
getEntry() can resolve a duplicate filename to the last entry, while extractAllTo() writes the first entry with that name. This can cause the application to validate one set of bytes but write different, unvalidated bytes to disk.
Are versions 0.6.1 and later affected?
The affected range is adm-zip versions before 0.6.1. Updating to 0.6.1 or later removes the affected version range described here.