Medium severity · published Oct 21, 2026
CVE-2026-114104
adm-zip before 0.6.1 Duplicate ZIP Entry Name Validation Bypass
5.9
CVSS
0.2%
EPSS
No
On KEV
Description
adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry names. Attackers can craft archives where getEntry() returns the last duplicate while extractAllTo() writes the first, causing unvalidated bytes to be written to disk.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
adm-zip · cthackers
before 0.6.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-114104
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-114104
github.com
https://github.com/cthackers/adm-zip/security/advisories/GHSA-p634-w6r4-rjp2
www.vulncheck.com
https://www.vulncheck.com/advisories/adm-zip-before-0.6.1-duplicate-zip-entry-name-validation-bypass
More from adm-zip
7.5
CVE-2026-114102
adm-zip before 0.6.1 Denial of Service via inflateAsync Unhandled Error Event
7.5
CVE-2026-77301
adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)
7.5
CVE-2026-92000
adm-zip 0.5.14 through 0.6.0 Denial of Service via Zero Declared Uncompressed Size
7.1
CVE-2026-102282
adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation
6.5
CVE-2026-76845
adm-zip 0.5.9 through 0.6.0 Arbitrary File Overwrite via Symlink Following on Extraction