Duplicate-entry Validation Bypass in adm-zip Library by CThackers

CVE-2026-116137

What is CVE-2026-116137?

The adm-zip library, up to version 0.6.1, is susceptible to a vulnerability that allows attackers to bypass the readEntries() validation check by using names of zip entries that are canonically equivalent, such as './hello.txt' and 'hello.txt'. This vulnerability could enable the extraction of malicious content to a specified path, circumventing the integrity checks that would typically validate the entry's authenticity. Attackers may craft Zip archives that, while appearing to contain legitimate content, can actually lead to the execution of harmful files, making this a significant security concern.

References