CVE-2026-116137

Name of the Vulnerable Software and Affected Versions adm-zip versions prior to 0.6.2

Description A duplicate-entry validation bypass exists where attackers can evade the readEntries() check by using canonically equivalent entry names, such as './hello.txt' and 'hello.txt'. This allows the creation of ZIP archives where getEntry() or readAsText() validates benign content, but extractAllTo() writes malicious content to the same path, bypassing integrity checks.

Recommendations Update adm-zip to version 0.6.2 or later.