CVE-2026-114104: adm-zip 0 to before 0.6.1

Affected technology

adm-zip · 0 to before 0.6.1
cthackers

Description’s affected range: before 0.6.1

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Attackers can craft archives where getEntry() returns the last duplicate while extractAllTo() writes the first, causing unvalidated bytes to be written to disk. Vendor/CNA’s CVSS 4.0 assessment (base score 8.2/10) rates confidentiality and availability impact as none; integrity impact as high.