{"id":"CVE-2026-114105","kind":"vulnerability","aliases":["CVE-2026-114105"],"related":[],"title":"adm-zip: crafted zip archives can set setuid bits on extracted files","description":"Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setgid, or sticky bits on extracted files when keepOriginalPermission is enabled. Attackers can craft zip external file attributes that pass unmasked into chmod, letting attacker-controlled executables gain elevated privileges when extracted as root and later run.","summary":"adm-zip before 0.6.1 passes unmasked external file attributes from a zip into chmod when keepOriginalPermission is enabled. An attacker who supplies a crafted archive can get setuid, setgid or sticky bits set on extracted files, so an executable can gain elevated privileges when extracted as root and later run.","severity":"medium","cvss":6.9,"epss":0.00105,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["adm-zip","node","npm","package","self-hosted"],"not_affected_if":["keeporiginalpermission-disabled","no-root-extraction","trusted-archives-only"],"how_to_check":"- Check the installed version with `npm ls adm-zip` and look for any version below `0.6.1`.\n- Search the code for `keepOriginalPermission` set to true in calls to adm-zip extract.\n- Check whether extraction runs as root on archives from untrusted sources.","fix":"- Upgrade adm-zip to `0.6.1` or later.\n- Until upgraded, leave `keepOriginalPermission` disabled or do not extract untrusted archives as root.","status":"open","published_at":"2026-10-21T01:17:36+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:39:06+00:00","updated_at":"2026-10-25T03:39:06+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:39:06Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade adm-zip to `0.6.1` or later.\n- Until upgraded, leave `keepOriginalPermission` disabled or do not extract untrusted archives as root.","reach":"unknown","title":"adm-zip: crafted zip archives can set setuid bits on extracted files","impact":"medium","summary":"adm-zip before 0.6.1 passes unmasked external file attributes from a zip into chmod when keepOriginalPermission is enabled. An attacker who supplies a crafted archive can get setuid, setgid or sticky bits set on extracted files, so an executable can gain elevated privileges when extracted as root and later run.","category":"package","nicknames":[],"who_cares":["node","npm","adm-zip","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker-chosen executable gains elevated privileges after root extraction and run","analyst_note":"","how_to_check":"- Check the installed version with `npm ls adm-zip` and look for any version below `0.6.1`.\n- Search the code for `keepOriginalPermission` set to true in calls to adm-zip extract.\n- Check whether extraction runs as root on archives from untrusted sources.","needs_analyst":false,"not_affected_if":["keepOriginalPermission-disabled","no-root-extraction","trusted-archives-only"],"who_is_affected":"Applications that use adm-zip before 0.6.1 to extract zip archives with keepOriginalPermission enabled, especially when the extraction runs as root and the archive comes from an untrusted source. Systems that only create archives, or extract trusted archives without that option, are less exposed. The sources do not say whether other extraction options are affected.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000652,"input_tokens":3392,"output_tokens":625,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114105':16A,19A '-2026':15A,18A '0.6.1':33B,84C 'adm':2A,21B,30B,81C 'adm-zip':1A,20B,29B,80C 'allow':92C 'archiv':6A,54B 'assign':89C 'attack':49B,93C,108C,122C 'attacker-control':121C 'attribut':38B,114C 'bit':10A,61B,100C 'chmod':43B,119C 'contain':85C 'control':123C 'craft':4A,53B,110C 'cve':14A,17A 'elev':71B,126C 'enabl':47B,107C 'execut':68B,124C 'extern':36B,112C 'extract':12A,64B,74B,102C,129C 'file':13A,37B,65B,103C,113C 'gain':70B,125C 'get':56B 'host':28B 'incorrect':87C 'keeporiginalpermiss':45B,105C 'later':78B,133C 'let':120C 'node':23B 'npm':24B 'packag':25B 'pass':34B,116C 'permiss':88C 'privileg':72B,127C 'root':76B,131C 'run':79B,134C 'self':27B 'self-host':26B 'set':8A,62B,95C 'setgid':58B,97C 'setuid':9A,57B,96C 'sticki':60B,99C 'suppli':51B 'unmask':35B,117C 'vulner':90C 'zip':3A,5A,22B,31B,41B,82C,111C","nicknames":[],"mitigations":[],"who_affected":"Applications that use adm-zip before 0.6.1 to extract zip archives with keepOriginalPermission enabled, especially when the extraction runs as root and the archive comes from an untrusted source. Systems that only create archives, or extract trusted archives without that option, are less exposed. The sources do not say whether other extraction options are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T01:17:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114105","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114105","severity":null,"published_at":"2026-10-21T01:17:36+00:00","modified_at":"2026-10-21T16:17:31+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114105","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114105","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}