Live › vulnerability › CVE-2026-116137
Go to dashboardadm-zip through 0.6.1 checks duplicate ZIP entries by exact name, so names like './hello.txt' and 'hello.txt' pass as distinct. An attacker can craft an archive where getEntry() or readAsText() returns benign content while extractAllTo() writes different content to the same path.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 12:40 UTC. All times on this page are UTC.
Applications that use adm-zip to extract ZIP files supplied by users or other untrusted parties, and rely on reading or validating entries before extracting them. Projects that only create archives or only extract trusted, internally produced ZIPs are less exposed. The sources do not say which default configurations are affected.
No product ranges from the sources yet.
npm ls adm-zip in each project to find installed versions and any transitive copies.0.6.1; the sources do not name the patched version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries() check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP archives where getEntry() or readAsText() validates benign content while extractAllTo() writes malicious content to the same path, bypassing integrity checks.
This page as .md · .json · in your agent: get_signal("CVE-2026-116137")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.