Vulnerability · Published Oct 21, 2026 · Assigned by VulnCheck

CVE-2026-114104adm-zip before 0.6.1 Duplicate ZIP Entry Name Validation Bypass

Medium 5.9

In plain English

A medium-severity security flaw in adm-zip from cthackers. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.3%top 73.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry names. Attackers can craft archives where getEntry() returns the last duplicate while extractAllTo() writes the first, causing unvalidated bytes to be written to disk.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	adm-zip	0.6.1	GHSA-p634-w6r4-rjp2

Affected products (as reported)

Vendor	Product	Versions
cthackers	adm-zip	0 – before 0.6.1

Weakness: CWE-436 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

References

GitHub Security Advisory (GHSA-p634-w6r4-rjp2) vendor-advisory
VulnCheck Advisory: adm-zip before 0.6.1 Duplicate ZIP Entry Name Validation Bypass third-party-advisory