Live › vulnerability › CVE-2026-114105
Go to dashboardadm-zip before 0.6.1 passes unmasked external file attributes from a zip into chmod when keepOriginalPermission is enabled. An attacker who supplies a crafted archive can get setuid, setgid or sticky bits set on extracted files, so an executable can gain elevated privileges when extracted as root and later run.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that use adm-zip before 0.6.1 to extract zip archives with keepOriginalPermission enabled, especially when the extraction runs as root and the archive comes from an untrusted source. Systems that only create archives, or extract trusted archives without that option, are less exposed. The sources do not say whether other extraction options are affected.
No product ranges from the sources yet.
npm ls adm-zip and look for any version below 0.6.1.keepOriginalPermission set to true in calls to adm-zip extract.0.6.1 or later.keepOriginalPermission disabled or do not extract untrusted archives as root.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setgid, or sticky bits on extracted files when keepOriginalPermission is enabled. Attackers can craft zip external file attributes that pass unmasked into chmod, letting attacker-controlled executables gain elevated privileges when extracted as root and later run.
This page as .md · .json · in your agent: get_signal("CVE-2026-114105")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.