CVE-2026-116137

A flaw was found in adm-zip. A remote attacker can exploit this issue by providing a specially crafted ZIP archive containing duplicate entries with equivalent path names to bypass validation checks. Consequently, an application may inspect benign file content during validation but write malicious content to the destination path upon extraction, leading to an integrity check bypass.

This vulnerability is rated as having a Low impact because exploitation depends on an atypical application pattern where individual archive entries are inspected for integrity prior to full extraction. In Red Hat environments, adm-zip is utilized within containerized platforms and developer tooling where decoupled validation routines on untrusted archives are not typically exposed or implemented. As a result, the risk of integrity check circumvention leading to compromised system state is minimal.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.