What’s Vulnerable › Vulnerabilities

CVE-2026-114105: Adm-zip before 0.6.1 Privilege Escalation via keepOriginalPermission Setuid Bits

• Severity: medium (CVSS 6.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-21 · updated 2026-10-21
• Weakness: CWE-732

Description

Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setgid, or sticky bits on extracted files when keepOriginalPermission is enabled. Attackers can craft zip external file attributes that pass unmasked into chmod, letting attacker-controlled executables gain elevated privileges when extracted as root and later run.

Affected products

• cthackers adm-zip: before 0.6.1 — fixed in 0.6.1

How to fix

Upgrade to a fixed version: cthackers adm-zip 0.6.1. Check the vendor advisory for mitigations.

References

• https://github.com/cthackers/adm-zip/security/advisories/GHSA-qjf8-53jv-w9w6
• https://www.vulncheck.com/advisories/adm-zip-before-0.6.1-privilege-escalation-via-keeporiginalpermission-setuid-bits

Get alerted when CVE-2026-114105 or the next vulnerability affects your stack