---
id: "CVE-2026-114105"
kind: "vulnerability"
aliases: ["CVE-2026-114105"]
title: "adm-zip: crafted zip archives can set setuid bits on extracted files"
severity: "medium"
cvss: 6.9
epss: 0.00105
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["adm-zip", "node", "npm", "package", "self-hosted"]
not_affected_if: ["keeporiginalpermission-disabled", "no-root-extraction", "trusted-archives-only"]
published_at: "2026-10-21T01:17:36+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T03:39:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114105", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114105", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# adm-zip: crafted zip archives can set setuid bits on extracted files

adm-zip before 0.6.1 passes unmasked external file attributes from a zip into chmod when keepOriginalPermission is enabled. An attacker who supplies a crafted archive can get setuid, setgid or sticky bits set on extracted files, so an executable can gain elevated privileges when extracted as root and later run.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `npm ls adm-zip` and look for any version below `0.6.1`.
- Search the code for `keepOriginalPermission` set to true in calls to adm-zip extract.
- Check whether extraction runs as root on archives from untrusted sources.

## Fix

- Upgrade adm-zip to `0.6.1` or later.
- Until upgraded, leave `keepOriginalPermission` disabled or do not extract untrusted archives as root.

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114105
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114105

## From the sources

Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setgid, or sticky bits on extracted files when keepOriginalPermission is enabled. Attackers can craft zip external file attributes that pass unmasked into chmod, letting attacker-controlled executables gain elevated privileges when extracted as root and later run.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_