CVE-2026-114104

A flaw was found in adm-zip. An attacker can exploit this vulnerability by supplying a specially crafted ZIP archive containing duplicate file names. Because the library resolves duplicate names inconsistently between its lookup and extraction routines, an application that validates a file before extracting the archive will inspect one entry while extracting another. This discrepancy allows unvalidated and potentially malicious files to be written to disk, bypassing security validation controls.

Moderate impact has been assigned to this flaw because successful exploitation depends on an uncommon programmatic pattern where an application validates individual archive entries prior to unpacking the entire archive. In affected Red Hat products incorporating adm-zip, risk is bounded by whether the service accepts unauthenticated or untrusted archive uploads and whether validation logic checks entry contents before batch extraction. Consequently, absent this specific verification architecture, the parsing inconsistency does not automatically result in privilege escalation or unauthorized disk modification.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.