CVE-2026-114104

Published: Ott 21, 2026 Last Modified: Ott 21, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 8,2
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM 5,9
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: high
Availability: none

Description

AI Translation Available

adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry names. Attackers can craft archives where getEntry() returns the last duplicate while extractAllTo() writes the first, causing unvalidated bytes to be written to disk.

436

Interpretation Conflict

Incomplete
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Other
Potential Impacts:
Unexpected State Varies By Context
Applicable Platforms
All platforms may be affected
View CWE Details
https://github.com/cthackers/adm-zip/security/advisories/GH…
https://github.com/cthackers/adm-zip/security/advisories/GHSA-p634-w6r4-rjp2
https://www.vulncheck.com/advisories/adm-zip-before-0.6.1-d…
https://www.vulncheck.com/advisories/adm-zip-before-0.6.1-duplicate-zip-entry-n…