A duplicate-entry validation bypass exists where attackers can evade the `readEntries()` check by using canonically equivalent entry names, such as './hello.txt' and 'hello.txt'. This allows the creation of ZIP archives where `getEntry()` or `readAsText()` validates benign content, but `extractAllTo()` writes malicious content to the same path, bypassing integrity checks.