Live › vulnerability › CVE-2026-114104
Go to dashboardadm-zip before 0.6.1 resolves duplicate entry names inconsistently: getEntry() returns the last copy while extractAllTo() writes the first. An attacker can therefore get bytes past a content check and onto disk.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that use adm-zip to extract ZIP archives supplied by users or other untrusted sources, and that validate entry contents before extraction. Projects that only create archives or only handle trusted archives are less exposed. unknown whether other adm-zip APIs are affected.
No product ranges from the sources yet.
npm ls adm-zip in each project to find the installed version.package-lock.json, yarn.lock, pnpm-lock.yaml) for adm-zip below 0.6.1.adm-zip to 0.6.1 or later.extractAllTo(), or validate entries by reading the same entry that gets written.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry names. Attackers can craft archives where getEntry() returns the last duplicate while extractAllTo() writes the first, causing unvalidated bytes to be written to disk.
This page as .md · .json · in your agent: get_signal("CVE-2026-114104")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.