CVE-2026-114105 Details
Description
Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setgid, or sticky bits on extracted files when keepOriginalPermission is enabled. Attackers can craft zip external file attributes that pass unmasked into chmod, letting attacker-controlled executables gain elevated privileges when extracted as root and later run.
A vulnerability in Adm-Zip versions prior to 0.6.1 allows attackers to manipulate file permissions during extraction, potentially leading to privilege escalation. When the 'keepOriginalPermission' option is enabled, Adm-Zip restores Unix permission bits from the zip entry's external file attributes without removing setuid, setgid, or sticky bits. This flaw enables crafted zip archives to create files with elevated permissions, executing attacker-controlled content with escalated privileges, particularly when extracted as root.
Users can upgrade to Adm-Zip version 0.6.1 or later, where this vulnerability has been patched. For those unable to upgrade, it's advisable to avoid using the 'keepOriginalPermission' option with untrusted zip archives.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-732 | Incorrect Permission Assignment for Critical Resource | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Adm-zip | <= 0.6.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 21, 2026 | CVE Modified | CISA-ADP |
| Oct 21, 2026 | New CVE Received | [email protected] |