CVE-2026-116137
Last modified
CVE-2026-116137 is a low-severity vulnerability rated 3.7/10 on the CVSS scale. adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries() check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP archives where getEntry() or readAsText() validates benign content while extractAllTo() writes malicious content to the same path, bypassing integrity checks..
Description
adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries() check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP archives where getEntry() or readAsText() validates benign content while extractAllTo() writes malicious content to the same path, bypassing integrity checks.
Metrics
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-116137?
How severe is CVE-2026-116137?
How do I fix CVE-2026-116137?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-116121A vulnerability was identified in NocoDB up to 2026.08.0. Th…3.7
- CVE-2026-116122A security flaw has been discovered in NocoDB up to 2026.07.…3.7
- CVE-2026-116123A weakness has been identified in NocoDB up to 2026.07.0. Th…3.7
- CVE-2026-116124A security vulnerability has been detected in GNOME libgsf u…6.3
- CVE-2026-11613The Divi Ajax Filter plugin for WordPress is vulnerable to L…9.8
- CVE-2026-116136ProjectSend 2.0.0 through 2.7.1 contains an incomplete autho…5.9
- CVE-2026-116139WWBN AVideo 26.0 through 29.3.0 contains a stored cross-site…5.4
- CVE-2026-11614The Xpro Addons — 140+ Widgets for Elementor plugin for Word…6.4
- CVE-2026-116140ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 incorre…3.3
- CVE-2026-116141ImageMagick before 7.1.2-33 contains a policy bypass vulnera…5.3
- CVE-2026-116142ImageMagick before 7.1.2-33 contains a heap buffer over-read…3.3
- CVE-2026-116143ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contain…3.3
Are you affected by CVE-2026-116137?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST