CVE-2026-116137Low· 3.7▾ Sunlitadm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries() check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP archives wh…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries() check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP archives where getEntry() or readAsText() validates benign content while extractAllTo() writes malicious content to the same path, bypassing integrity checks.
adm-zip <= 0.6.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114104Medium· 5.9adm-zip before 0.6.1 Duplicate ZIP Entry Name Validation Bypass
CVE-2026-92000High· 7.5adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size
GHSA-p634-w6r4-rjp2Medium· 5.9adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content
CVE-2026-76845Medium· 6.5adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination
CVE-2026-114103Medium· 5.3adm-zip 0.6.0 Decompression Bomb Guard Bypass via getDataAsync()
CVE-2026-114105Medium· 6.2Adm-zip before 0.6.1 Privilege Escalation via keepOriginalPermission Setuid Bits