---
id: CVE-2026-116137
title: >-
  adm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically
  Equivalent Names
summary: >-
  adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows
  attackers to evade the readEntries() check by using canonically equivalent
  entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP
  archives wh…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-436
vendor: cthackers
product: adm-zip
affected:
  - adm-zip <= 0.6.1
published: '2026-10-25'
updated: '2026-10-25'
sourceUpdated: '2026-10-25T11:51:01.980Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116137'
references:
  - url: 'https://github.com/cthackers/adm-zip/issues/587'
    label: 'GitHub Issue #587'
  - url: 'https://github.com/cthackers/adm-zip'
  - url: >-
      https://github.com/cthackers/adm-zip/blob/cb2cf9ba4c7c865db426e2de1997cb41194d9872/zipFile.js#L81-L92
  - url: >-
      https://github.com/cthackers/adm-zip/blob/cb2cf9ba4c7c865db426e2de1997cb41194d9872/adm-zip.js#L87
  - url: >-
      https://github.com/cthackers/adm-zip/blob/cb2cf9ba4c7c865db426e2de1997cb41194d9872/util/utils.js#L383
  - url: >-
      https://www.vulncheck.com/advisories/adm-zip-through-0.6.1-duplicate-entry-validation-bypass-via-canonically-equivalent-names
    label: >-
      VulnCheck Advisory: adm-zip through 0.6.1 Duplicate-Entry Validation
      Bypass via Canonically Equivalent Names
tags:
  - cve.org
ingestedAt: '2026-10-25T22:08:29.958Z'
---

## Overview

adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries() check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP archives where getEntry() or readAsText() validates benign content while extractAllTo() writes malicious content to the same path, bypassing integrity checks.

## Affected

- `adm-zip <= 0.6.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.