---
id: CVE-2026-114105
title: >-
  Adm-zip before 0.6.1 Privilege Escalation via keepOriginalPermission Setuid
  Bits
summary: >-
  Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability
  that allows attackers to set setuid, setgid, or sticky bits on extracted files
  when keepOriginalPermission is enabled. Attackers can craft zip external file
  a…
severity: medium
cvss: 6.2
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-732
vendor: cthackers
product: adm-zip
affected:
  - adm-zip < 0.6.1
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T00:37:06.018Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114105'
references:
  - url: >-
      https://github.com/cthackers/adm-zip/security/advisories/GHSA-qjf8-53jv-w9w6
    label: GitHub Security Advisory (GHSA-qjf8-53jv-w9w6)
  - url: >-
      https://www.vulncheck.com/advisories/adm-zip-before-0.6.1-privilege-escalation-via-keeporiginalpermission-setuid-bits
    label: >-
      VulnCheck Advisory: Adm-zip before 0.6.1 Privilege Escalation via
      keepOriginalPermission Setuid Bits
tags:
  - cve.org
ingestedAt: '2026-10-21T01:37:08.013Z'
---

## Overview

Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setgid, or sticky bits on extracted files when keepOriginalPermission is enabled. Attackers can craft zip external file attributes that pass unmasked into chmod, letting attacker-controlled executables gain elevated privileges when extracted as root and later run.

## Affected

- `adm-zip < 0.6.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.