adm-zip_LPE-PoC

CVE-2026-102282: adm-zip Local Privilege Escalation via SUID Preservation Description adm-zip is an established, pure-JavaScript ZIP archive library for Node.js with over 20 million weekly downloads across the npm ecosystem. It is widely integrated into CI/CD pipelines, container build workflows,...

POC-CVE-2026-102282

CVE-2026-102282 — adm-zip setuid/setgid preservation during extraction Incorrect permission assignment in the npm package adm-zip. Extraction can keep setuid, setgid, and sticky bits from an untrusted zip when keepOriginalPermission is enabled, allowing a root-owned setuid executable to be plante...

Interpretation Conflict

Overview adm-zip is a JavaScript implementation for zip data compression for NodeJS. Affected versions of this package are vulnerable to Interpretation Conflict via canonically equivalent ZIP entry names e.g., ./hello.txt and hello.txt, which causes readEntries to treat them as distinct entries...

CVE-2026-116137

A flaw was found in adm-zip. A remote attacker can exploit this issue by providing a specially crafted ZIP archive containing duplicate entries with equivalent path names to bypass validation checks. Consequently, an application may inspect benign file content during validation but write maliciou...

CVE-2026-116137

adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP archives where getEntry or readAsText validates benign content while...

CVE-2026-116137 adm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent Names

adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP archives where getEntry or readAsText validates benign content while...

CVE-2026-116137

adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP archives where getEntry or readAsText validates benign content while...

EUVD-2026-109389

adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP archives where getEntry or readAsText validates benign content while...

CVE-2026-116137

The adm-zip library (through version 0.6.1 ) is vulnerable to a duplicate-entry validation bypass (CWE-436). The root cause is the failure to recognize canonically equivalent names , such as ./hello.txt and hello.txt, during validation. Attackers can craft ZIP archives where functions like getEnt...

CVE-2026-116137 adm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent Names

adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP archives where getEntry or readAsText validates benign content while...

Red Hat: CVE-2026-116137: adm-zip: adm-zip: File integrity check bypass via duplicate archive entries

adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP archives where getEntry or readAsText validates benign content while...

PT-2026-122978

adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP archives where getEntry or readAsText validates benign content while...

Linux Distros Unpatched Vulnerability : CVE-2026-116137

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries check by using canonically equivalent entry...

CVE-2026-114105

A flaw was found in adm-zip. This vulnerability allows an attacker to achieve privilege escalation when an archive is extracted with the option to preserve original permissions enabled. By providing a specially crafted ZIP archive containing elevated permission attributes, unmasked execution flag...

Adm-zip: Duplicate ZIP Entry Names: GetEntry() And ExtractAllTo() Resolve To Different Content

Summary A ZIP file can contain two entries with the identical name. adm-zip keeps both in its internal entry list, but its name-lookup table only retains the last one written. "getEntryname" and "extractAllTo" walk these two different internal structures, so they can each resolve a duplicate name...

CVE-2026-114103

A flaw was found in adm-zip. The asynchronous extraction mechanism fails to enforce maximum output size limits when decompressing files, bypassing decompression bomb protections. A remote attacker can exploit this flaw by submitting a specially crafted ZIP archive with an artificially small...

Adm-zip: GetDataAsync() Bypasses The MaxOutputLength Size Guard Enforced By The Synchronous GetData() Path

Summary adm-zip enforces a "maxOutputLength" guard against decompression bombs on its synchronous "getData" path, but the equivalent asynchronous "getDataAsync" path does not enforce it — it accumulates and returns the entire decompressed output regardless of the entry's declared size. An...

Adm-zip: Unhandled Error Event In Async DEFLATE Decompression Crashes Node.js Process (DoS)

Summary Denial of Service in "adm-zip"'s async decompression API allows an unauthenticated attacker to crash the entire Node.js host process by supplying a single malformed ZIP file. Details Affected package: adm-zip Affected versions: at least 0.6.0 current latest; likely all versions containing...

CVE-2026-114104

A flaw was found in adm-zip. An attacker can exploit this vulnerability by supplying a specially crafted ZIP archive containing duplicate file names. Because the library resolves duplicate names inconsistently between its lookup and extraction routines, an application that validates a file before...

CVE-2026-114102

A flaw was found in adm-zip. A remote, unauthenticated attacker could cause a Denial of Service DoS by submitting a malformed or corrupted ZIP archive to an application using asynchronous decompression. Because the library fails to properly handle decompression stream errors, processing the inval...