Is CVE-2026-114104 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114104 being exploited in the wild.

How severe is CVE-2026-114104?

Medium severity, with a CVSS score of 5.9, published 21 October 2026.

Is there a fix for CVE-2026-114104?

Yes: fixed in 0.6.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-114104 attacked?

It is attacked over the network.

Am I affected by CVE-2026-114104?

Check whether you run Adm-Zip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114104: adm-zip inconsistent entry resolution in ZIP extraction

CVE-2026-114104 · Severity: medium · CVSS 5.9 · Published 2026-10-21

adm-zip is a JavaScript library for reading and writing ZIP archives. The library has a flaw where duplicate entry names in a ZIP file are handled inconsistently: one function returns the last duplicate while another writes the first, allowing attackers to bypass content validation. An application that validates a ZIP entry before extraction could approve one file's content while actually writing different bytes to disk.

Quick answers

Is CVE-2026-114104 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114104 being exploited in the wild.
How severe is CVE-2026-114104?: Medium severity, with a CVSS score of 5.9, published 21 October 2026.
Which products and versions are affected?: Adm-Zip before 0.6.1.
Is there a fix for CVE-2026-114104?: Yes: fixed in 0.6.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114104 attacked?: It is attacked over the network.
Am I affected by CVE-2026-114104?: Check whether you run Adm-Zip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 0.6.1

Technical details

The vulnerability stems from inconsistent data structure usage: getEntry() lookups use an entry table that retains only the last duplicate entry, while extractAllTo() iterates an entry list that contains all duplicates in order. An attacker crafts a malicious ZIP with duplicate entry names to cause getEntry() and extractAllTo() to resolve the same name to different content, bypassing validate-then-extract patterns.

Affected products

adm-zip before 0.6.1

Timeline

2026-09-11: disclosed
2026-10-21: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.