Bug 2560378 (CVE-2026-116137)

Summary: CVE-2026-116137 adm-zip: adm-zip: File integrity check bypass via duplicate archive entries
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: abarbaro, akhatavk, alizardo, aos-team-art-private, asdas, cdrage, cmyers, dnakabaa, dpaolell, dschmidt, gbenhaim, gmalinko, gparvin, janstey, jbalunas, jchui, jdelft, jhe, jlanda, jupierce, kaycoth, kshier, ktsao, lcouzens, lgarciaa, mbiarnes, nboldt, niyer, oaljalju, pdelbell, ppalepu, ppostler, prdhamdh, psrna, rbobbitt, rhaigner, rhel-process-autobot, rstepani, rushinde, sghai, sidsharm, simaishi, stcannon, suppawar, tsze, twaugh, vlaad, watson-tool-maintainers, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in adm-zip. A remote attacker can exploit this issue by providing a specially crafted ZIP archive containing duplicate entries with equivalent path names to bypass validation checks. Consequently, an application may inspect benign file content during validation but write malicious content to the destination path upon extraction, leading to an integrity check bypass.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-25 12:01:54 UTC 
adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries() check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP archives where getEntry() or readAsText() validates benign content while extractAllTo() writes malicious content to the same path, bypassing integrity checks.