CVE-2026-116137: adm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent Names
adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries() check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP archives where getEntry() or readAsText() validates benign content while extractAllTo() writes malicious content to the same path, bypassing integrity checks.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using npm/adm-zip through 0.6.1 are exposed when they process attacker-crafted ZIP archives and rely on entry validation or integrity checks before extracting files.
What does an attacker need to exploit it?
An attacker needs to supply a ZIP archive containing duplicate entries with canonically equivalent names, such as './hello.txt' and 'hello.txt'. The archive can cause validation through getEntry() or readAsText() to inspect benign content while extractAllTo() writes malicious content to the same path.
How can I determine whether my application is affected?
Check whether the application uses adm-zip through version 0.6.1 and accepts ZIP files from an attacker-influenced source. It is specifically affected if it validates archive entries with readEntries(), getEntry(), or readAsText() and later extracts the archive with extractAllTo().