CVE-2026-114104

The record

adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry names. Attackers can craft archives where getEntry() returns the last duplicate while extractAllTo() writes the first, causing unvalidated bytes to be written to disk.

Affected packages

Related vulnerabilities

• CVE-2026-61789 DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. CWE-436
• CVE-2026-119200 Nuxt is an open-source web development framework for Vue.js. CWE-436
• CVE-2026-119190 Forge (also called node-forge) is a native implementation of Transport Layer Security in… CWE-436
• CVE-2026-116266 MIME::Head versions from 5.518 before 5.521 for Perl decode a partly encoded multipart… CWE-436
• CVE-2026-116272 MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary… CWE-436
• CVE-2026-116269 MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a… CWE-436
• CVE-2026-116264 MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type… CWE-436
• CVE-2026-116265 MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart… CWE-436