CVE-2026-114104 adm-zip before 0.6.1 Duplicate ZIP Entry Name Validation Bypass
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-114104?
CVE-2026-114104 is a high-severity vulnerability in cthackers adm-zip, published on 21 Oct 2026.
Official description
adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry names. Attackers can craft archives where getEntry() returns the last duplicate while extractAllTo() writes the first, causing unvalidated bytes to be written to disk.
Weakness: CWE-436
Which versions are affected by CVE-2026-114104?
2 open source packages ship an affected version, including adm-zip.
| Package | Affected | Fixed in |
|---|---|---|
adm-zip npm | All versions | 0.6.1 |
adm-zip npm | All versions | 0.6.1 |
How do I fix CVE-2026-114104?
Upgrade adm-zip to 0.6.1 or later.
Is CVE-2026-114104 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-114104 exists.
Sources
Also known as CLEANSTART-2026-DD09882, CLSA-2026-1790854760, CLSA-2026-1790868332, CLSA-2026-1790869902, CLSA-2026-1791666093, CLSA-2026-1791666292 and 17 more.