CVE-2026-116137

The adm-zip library (through version 0.6.1 ) is vulnerable to a duplicate-entry validation bypass (CWE-436). The root cause is the failure to recognize canonically equivalent names , such as ./hello.txt and hello.txt, during validation. Attackers can craft ZIP archives where functions like getEnt...

CVE-2026-116137 adm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent Names

adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP archives where getEntry or readAsText validates benign content while...