---
id: CVE-2026-116137
title: >-
  adm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically
  Equivalent Names
summary: >-
  adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows
  attackers to evade the readEntries() check by using canonically equivalent
  entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP
  archives wh…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-436
  - CWE-41
vendor: cthackers
product: adm-zip
affected:
  - adm-zip <= 0.6.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-29T16:09:12.519031Z'
published: '2026-10-25'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T16:09:24.168Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116137'
references:
  - url: 'https://github.com/cthackers/adm-zip/issues/587'
    label: 'GitHub Issue #587'
  - url: 'https://github.com/cthackers/adm-zip'
  - url: >-
      https://github.com/cthackers/adm-zip/blob/cb2cf9ba4c7c865db426e2de1997cb41194d9872/zipFile.js#L81-L92
  - url: >-
      https://github.com/cthackers/adm-zip/blob/cb2cf9ba4c7c865db426e2de1997cb41194d9872/adm-zip.js#L87
  - url: >-
      https://github.com/cthackers/adm-zip/blob/cb2cf9ba4c7c865db426e2de1997cb41194d9872/util/utils.js#L383
  - url: >-
      https://www.vulncheck.com/advisories/adm-zip-through-0.6.1-duplicate-entry-validation-bypass-via-canonically-equivalent-names
    label: >-
      VulnCheck Advisory: adm-zip through 0.6.1 Duplicate-Entry Validation
      Bypass via Canonically Equivalent Names
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-116137.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-116137'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2560378'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-116137'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-116137'
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00258
epssPercentile: 0.17526
ingestedAt: '2026-10-25T22:08:29.958Z'
---

## Overview

adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries() check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP archives where getEntry() or readAsText() validates benign content while extractAllTo() writes malicious content to the same path, bypassing integrity checks.

## Affected

- `adm-zip <= 0.6.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Low · affected: Cost Management On Premise, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Build of Podman Desktop, Red Hat Connectivity Link 1, Red Hat Developer Hub, Red Hat Enterprise Linux 8, … · no fix planned: Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Fuse 7, Cost Management On Premise, Red Hat Build of Podman Desktop, … · updated 2026-10-25 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-116137.json)