Vulnerability · Published Oct 25, 2026 · Assigned by VulnCheck

CVE-2026-116137adm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent Names

Low 3.7

In plain English

A low-severity security flaw in adm-zip from cthackers. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)3.7Low

Exploit odds (30 days)0.3%top 82.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries() check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP archives where getEntry() or readAsText() validates benign content while extractAllTo() writes malicious content to the same path, bypassing integrity checks.

Affected products (as reported)

Vendor	Product	Versions
cthackers	adm-zip	0 – through 0.6.1

Weakness: CWE-436 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References

GitHub Issue #587 issue-tracking
https://github.com/cthackers/adm-zip product
https://github.com/cthackers/adm-zip/blob/cb2cf9ba4c7c865db426e2de1997cb41194d9872/zipFile.js#L81-L92 technical-description
https://github.com/cthackers/adm-zip/blob/cb2cf9ba4c7c865db426e2de1997cb41194d9872/adm-zip.js#L87 technical-description
https://github.com/cthackers/adm-zip/blob/cb2cf9ba4c7c865db426e2de1997cb41194d9872/util/utils.js#L383 technical-description
VulnCheck Advisory: adm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent Names third-party-advisory