CVE-2026-116137
Gravedad CVSS v4.0:
MEDIA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
25/10/2026
Última modificación:
25/10/2026
Descripción
*** Pendiente de traducción *** adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries() check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP archives where getEntry() or readAsText() validates benign content while extractAllTo() writes malicious content to the same path, bypassing integrity checks.
Impacto
Puntuación base 4.0
6.30
Gravedad 4.0
MEDIA
Puntuación base 3.x
3.70
Gravedad 3.x
BAJA
Referencias a soluciones, herramientas e información
- https://github.com/cthackers/adm-zip
- https://github.com/cthackers/adm-zip/blob/cb2cf9ba4c7c865db426e2de1997cb41194d9872/adm-zip.js#L87
- https://github.com/cthackers/adm-zip/blob/cb2cf9ba4c7c865db426e2de1997cb41194d9872/util/utils.js#L383
- https://github.com/cthackers/adm-zip/blob/cb2cf9ba4c7c865db426e2de1997cb41194d9872/zipFile.js#L81-L92
- https://github.com/cthackers/adm-zip/issues/587
- https://www.vulncheck.com/advisories/adm-zip-through-0.6.1-duplicate-entry-validation-bypass-via-canonically-equivalent-names