Adm-zip Incorrect Permission Assignment Leading to Privilege Escalation

Executive Summary

CVE-2026-114105 is a vulnerability in the adm-zip library before version 0.6.1. When the keepOriginalPermission feature is enabled, attackers can manipulate zip files to set setuid, setgid, or sticky bits on extracted files. These special permission bits allow executables to run with elevated privileges. The vulnerability occurs because unmasked attributes from the zip file pass directly into the chmod command, enabling privilege escalation if files are extracted by a root process.

Useful 0 Not Useful 0

Detection Guidance

Check if adm-zip versions before 0.6.1 are installed using package managers like npm (npm list adm-zip) or by inspecting installed modules. Review zip files with setuid/setgid bits set in their external attributes. Use commands like find / -perm -4000 -o -perm -2000 to locate files with elevated permissions.

Useful 0 Not Useful 0

Impact Analysis

If you use adm-zip versions before 0.6.1 with keepOriginalPermission enabled, an attacker could craft a malicious zip file that sets elevated permissions on extracted files. If these files are extracted by a root process, the attacker could gain elevated privileges on your system. This could allow unauthorized access, control over critical files, or further exploitation of your system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily enables local privilege escalation by allowing attackers to set setuid, setgid, or sticky bits on extracted files. While not directly violating GDPR or HIPAA, it could indirectly impact compliance by enabling unauthorized access to sensitive data or systems if exploited in environments handling protected information.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade adm-zip to version 0.6.1 or later immediately. Disable the keepOriginalPermission feature if not required. Avoid extracting untrusted zip files as root. Review and remove any setuid/setgid bits from files extracted by adm-zip.

Useful 0 Not Useful 0