CVE-2026-116137: 
Linux Red Hat vulnerability analysis and mitigation

CVE-2026-116137 is a duplicate-entry validation bypass vulnerability in the adm-zip Node.js library (versions through 0.6.1) that allows attackers to craft malicious ZIP archives where integrity checks validate benign content while malicious content is written to disk during extraction. The flaw was disclosed on October 25, 2026, and affects all versions of adm-zip up to and including 0.6.1, maintained by cthackers. It carries a CVSS v3.1 base score of 3.7 (Low) and a CVSS v4.0 base score of 6.3 (Medium) (Red Hat Advisory, GitHub Advisory).

The root cause is an interpretation conflict (CWE-436) combined with improper resolution of path equivalence (CWE-41). The readEntries() function in zipFile.js (lines 81–92) stores entries in both a list (entryList) and a hash table (entryTable), but the duplicate-name check compares only exact decoded entry names — it does not account for canonically equivalent names such as ./hello.txt and hello.txt, or path-traversal equivalents like a/../x and x. When extractAllTo() iterates entryList, util/utils.js:383 normalizes these names to the same path; writeFileTo() then silently returns false for the second write because the target already exists, and extractAllTo() ignores that return value (adm-zip.js:808). An attacker can therefore place a benign entry first (validated by getEntry() or readAsText()) and a malicious entry second (written to disk by extractAllTo()), bypassing any pre-extraction integrity check (GitHub Issue #587, VulnCheck Advisory).

Successful exploitation allows an unauthenticated attacker to write arbitrary file content to a target path on disk during ZIP extraction, even when the application has validated the archive's contents beforehand. The primary impact is an integrity violation — a file that passed validation is silently replaced by attacker-controlled content — which could enable code execution if the overwritten file is subsequently loaded or executed by the application. Confidentiality and availability are not directly impacted by this vulnerability, but the integrity compromise could serve as a stepping stone for further attacks such as supply-chain tampering or remote code execution in dependent applications (Feedly, GitHub Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is 0.0, reflecting a very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to supply a specially crafted ZIP archive to a target application that uses adm-zip for extraction, making it dependent on the application's attack surface (e.g., file upload endpoints).

1. Identify a target: Find a Node.js application that accepts user-supplied ZIP files and uses adm-zip (≤0.6.1) to validate and extract them — for example, a file upload endpoint that calls getEntry() or readAsText() for validation before calling extractAllTo().
2. Craft the malicious ZIP: Create a ZIP archive with two entries that normalize to the same path after canonicalization. For example, include entry ./target.js with benign content (content A) as the first entry, and entry target.js with malicious content (content B) as the second entry.
3. Bypass validation: Submit the crafted ZIP to the target application. When the application calls getEntry('target.js') or readAsText('target.js'), it retrieves the last entry stored in entryTable — which may be the benign entry — and validates it as safe.
4. Trigger malicious extraction: The application proceeds to call extractAllTo(targetDir). During extraction, entryList is iterated in order; the first entry (./target.js) is written to targetDir/target.js. When the second entry (target.js) is processed, writeFileTo() returns false (file exists, overwrite=false), and the error is silently ignored — leaving the first entry's content on disk.
5. Achieve objective: Depending on entry ordering and the overwrite flag, the attacker controls which content lands on disk. By ordering entries so the malicious content is written first (or by enabling overwrite), the attacker can place a malicious file (e.g., a backdoor script) at a path that the application will subsequently load or execute (GitHub Issue #587, VulnCheck Advisory).

• File System: Unexpected or recently modified files in ZIP extraction target directories, particularly files whose content differs from what was expected based on pre-extraction validation; presence of files with names that are canonical equivalents of other entries (e.g., both ./config.js and config.js resolving to the same path).
• Logs: Application logs showing successful ZIP extraction immediately followed by unexpected application behavior or errors loading extracted files; Node.js process errors referencing adm-zip extraction paths.
• Network: Unusual file upload requests containing ZIP archives with duplicate or canonically equivalent entry names (detectable via deep packet inspection or WAF rules examining ZIP central directory structure).
• Process: Unexpected child processes or script execution originating from directories used as ZIP extraction targets, particularly if those directories contain application code.

Update adm-zip to a version beyond 0.6.1 once a patched release is available; monitor the adm-zip GitHub repository and the GitHub Advisory for patch announcements (Red Hat Advisory). As an interim workaround, validate ZIP file sources strictly and implement additional integrity verification independent of adm-zip's readEntries() function — for example, by comparing the canonical paths of all entries before extraction and rejecting archives with duplicate normalized names. Consider running ZIP extraction in an isolated environment (e.g., a sandboxed container) with restricted write permissions to limit the impact of any file written during extraction.

The vulnerability was reported to the adm-zip project via GitHub Issue #587 by researcher Figo5 on October 21, 2026, with a detailed technical description of the path normalization flaw and its silent failure mode (GitHub Issue #587). Red Hat has tracked the CVE with a "Deferred" status, indicating it is acknowledged but not yet addressed in their products (Red Hat Advisory). No significant broader media coverage or notable social media reactions have been identified at this time.