adm-zip CVE-2026-114104: Inconsistent Entry Resolution Bypasses Validation
A high-severity flaw in adm-zip allows attackers to write unvalidated data to disk by exploiting duplicate entries in ZIP archives.
Key points
- CVE-2026-114104 affects adm-zip versions prior to 0.6.1.
- The vulnerability allows bypassing content validation through crafted archives.
- National Vulnerability Database rates the flaw as high severity with a CVSS score of 8.2.
The Node.js package adm-zip contains a high-severity vulnerability that enables attackers to bypass content validation. This flaw, identified as CVE-2026-114104, stems from inconsistent handling of duplicate file entries within ZIP archives. Security researchers note that the issue allows malicious actors to write unvalidated bytes directly to the filesystem.
Root cause
The underlying weakness is classified as CWE-436, or inconsistent interpretation of data. According to the National Vulnerability Database, the adm-zip library processes duplicate entry names in conflicting ways. When a ZIP archive contains multiple entries with the same name, the `getEntry()` function returns the last occurrence. However, the `extractAllTo()` function writes the first occurrence to disk.
Attack path
Attackers can exploit this discrepancy by crafting ZIP archives that contain duplicate entry names. By manipulating the archive structure, an adversary ensures that the entry returned for validation checks differs from the entry actually extracted. This mismatch allows unvalidated content to be written to the target system’s storage.
Affected versions
The vulnerability impacts all versions of adm-zip released before 0.6.1. Developers using earlier iterations of the library are exposed to this risk. The package is maintained by cthackers.
Mitigation
- Upgrade adm-zip to version 0.6.1 or later immediately.
- Implement server-side validation for all uploaded ZIP archives.
- Restrict write permissions for directories where archives are extracted.
- Monitor filesystem changes for unexpected file creation during extraction.
Detection notes
Security teams usually detect this activity by monitoring for unusual file creation events in extraction directories. Check whether logs show discrepancies between expected and actual file contents after archive processing. Look for alerts triggered by files appearing with unexpected permissions or timestamps. Investigate any instances where validation scripts report clean archives but subsequent analysis reveals malicious payloads. Containment moves typically involve isolating affected servers and reviewing recent archive uploads for anomalies.
What to do and how to stay safe: adm-zip
- Audit your dependencies to identify any use of adm-zip versions prior to 0.6.1.
- Review server logs for evidence of ZIP extraction activities that may have bypassed validation.
- Implement strict input validation for all user-supplied archives before processing them.
- Once the vendor provides an update, apply the patch to all affected systems immediately.
Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You
General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-114104?
The National Vulnerability Database assigns a CVSS score of 8.2, rating it as high severity.
Which versions of adm-zip are affected by this vulnerability?
All versions of adm-zip prior to 0.6.1 are affected by this inconsistent entry resolution flaw.
How does the vulnerability allow attackers to bypass validation?
Attackers craft archives with duplicate entries, causing getEntry() and extractAllTo() to process different files.
