CVE-2026-114105 in adm-zip
Summary
by MITRE • 10/22/2026
Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setgid, or sticky bits on extracted files when keepOriginalPermission is enabled. Attackers can craft zip external file attributes that pass unmasked into chmod, letting attacker-controlled executables gain elevated privileges when extracted as root and later run.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in Adm-zip versions prior to 0.6.1 represents a critical flaw in the handling of Unix-style permission bits during archive extraction operations. This issue is classified under CWE-732, which pertains to incorrect permission assignment for essential files and resources. The core technical defect lies within the library's logic when the keepOriginalPermission flag is enabled. In this mode, Adm-zip attempts to preserve the file permissions stored in the ZIP archive metadata by applying them directly to the extracted files on the host system using standard operating system calls such as chmod. However, the implementation fails to mask or validate specific high-risk permission bits before application. Specifically, it allows external file attributes from the zip entry to pass unmasked into the underlying system call responsible for setting permissions. This lack of sanitization means that if an attacker crafts a malicious ZIP archive containing entries with setuid, setgid, or sticky bit flags enabled in their metadata, these bits will be applied directly to the extracted files without restriction.
The operational impact of this vulnerability is severe, particularly in environments where extraction scripts are executed with elevated privileges, such as by the root user or within a containerized environment running as root. When an attacker-controlled executable file possessing setuid or setgid bits is extracted and subsequently executed by any user on the system, it triggers privilege escalation. The operating system will execute this binary with the permissions of its owner (for setuid) or group (for setgid), which in this context would be root due to the extraction process being performed as a privileged user. This effectively allows an unprivileged attacker to gain full administrative control over the affected system simply by tricking a service into extracting their crafted archive. The sticky bit, while less directly exploitable for immediate privilege escalation on modern systems with restricted setuid binaries, still represents a significant integrity violation and can be leveraged in conjunction with other vulnerabilities or specific kernel exploits to compromise file security boundaries.
From the perspective of threat modeling and adversary behavior, this vulnerability aligns closely with MITRE ATT&CK techniques related to Privilege Escalation via Binary Exploitation or Abuse Elevation Control Mechanisms. Attackers typically exploit such flaws by embedding malicious payloads within seemingly benign archives, relying on automated processes like email gateways, CI/CD pipelines, or file upload services that automatically extract contents for scanning or processing. The failure to sanitize permission bits demonstrates a lack of defense-in-depth in the library's design, assuming that input from ZIP files is inherently safe regarding metadata integrity. This assumption is flawed because ZIP archives are often generated by users with varying levels of technical expertise and security awareness, making them a common vector for supply chain attacks or social engineering campaigns aimed at compromising server infrastructure.
To mitigate this risk, organizations must immediately upgrade Adm-zip to version 0.6.1 or later, where the developers have implemented proper masking logic to strip dangerous permission bits such as setuid and setgid before applying them during extraction. For systems that cannot be updated instantly due to dependency constraints, a temporary mitigation involves ensuring that any process utilizing Adm-zip does not run with root privileges unless absolutely necessary, thereby reducing the likelihood of successful privilege escalation even if an attacker manages to inject malicious permission bits. Additionally, implementing strict input validation on uploaded archives and using sandboxed environments for extraction can further limit the blast radius of such attacks. Security teams should also audit their CI/CD pipelines and file processing services to ensure they are not inadvertently relying on unpatched versions of this library in production workflows where external data is processed automatically.