adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content
Summary
A ZIP file can contain two entries with the identical name. adm-zip keeps both in its internal entry list, but its name-lookup table only retains the last one written. getEntry(name) and extractAllTo() walk these two different internal structures, so they can each resolve a duplicate name to a different entry. An application that validates a named entry's contents via getEntry() before trusting an archive, then extracts the whole archive, can end up approving one file's content while a different file's bytes are what actually land on disk under that name.
Details
zipFile.js:58-83retains both entries inentryListbut overwritesentryTable[name]with only the last one written.adm-zip.js:83-95,658-663usesentryTableforgetEntry()lookups — returns the last duplicate.adm-zip.js:769-914iteratesentryListfor extraction — writes the first duplicate (sync, default overwrite policy).
PoC
const AdmZip = require('adm-zip');
const z = new AdmZip({ noSort: true });
z.addFile('a.txt', Buffer.from('FIRST'));
z.addFile('b.txt', Buffer.from('SECOND'));
const raw = Buffer.from(z.toBuffer());
// rename the a.txt entry to b.txt directly in the raw bytes
for (let at = raw.indexOf('a.txt'); at >= 0; at = raw.indexOf('a.txt', at + 5)) {
raw.write('b.txt', at);
}
const parsed = new AdmZip(raw, { noSort: true });
const validated = parsed.getEntry('b.txt').getData().toString();
parsed.extractAllTo(outDir, false);
// validated === "SECOND", but the file written to disk === "FIRST"Reproduced on the pinned commit (2b4d84087d45344643e0183756e19191d52815cc)
Impact
An application that checks a named entry's content before trusting an untrusted ZIP, then extracts it, can be made to approve different bytes than what actually gets written to disk — the classic check/use split that this kind of validate-then-extract pattern relies on.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de npm | adm-zip | < 0.6.1 | 0.6.1 |
Referencias
- Vector CVSS
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N- Debilidad (CWE)
CWE-436, CWE-696- Plataforma
- npm
- Paquete
adm-zip- Publicada
- 29.09.2026
- Actualizado
- 21.10.2026 14:17
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-p634-w6r4-rjp2 - CC BY 4.0
Historial de vulnerabilidades: adm-zip
Todas las vulnerabilidades publicadas de este paquete (Paquete de npm), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 9
- Primera → última
- 07.2018 09.2026
- Sin corrección
- 1
- Explotada en ataques
- 0
Distribución por gravedad
- Alta 5
- Media 4
Divulgaciones por año
- 2018: 1
- 2019: 0
- 2020: 0
- 2021: 0
- 2022: 0
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 8
-
adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.