CVE-2026-116137 adm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent Names

Medium 6.3 Published 25 Oct 2026 Updated 29 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-116137?

CVE-2026-116137 is a medium-severity vulnerability in cthackers adm-zip, published on 25 Oct 2026.

Official description

adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries() check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP archives where getEntry() or readAsText() validates benign content while extractAllTo() writes malicious content to the same path, bypassing integrity checks.

Weakness: CWE-436

Which versions are affected by CVE-2026-116137?

How do I fix CVE-2026-116137?

No fix has been published for CVE-2026-116137 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-116137 being exploited?

There is no known exploitation of CVE-2026-116137 in the wild and no public exploit code.

Sources

Also known as AZL-111398, GHSA-mv5w-h6hm-qcp7.