CVE-2026-114105 Adm-zip before 0.6.1 Privilege Escalation via keepOriginalPermission Setuid Bits
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-114105?
CVE-2026-114105 is a medium-severity vulnerability in cthackers adm-zip, published on 21 Oct 2026.
Official description
Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setgid, or sticky bits on extracted files when keepOriginalPermission is enabled. Attackers can craft zip external file attributes that pass unmasked into chmod, letting attacker-controlled executables gain elevated privileges when extracted as root and later run.
Weakness: CWE-732
Which versions are affected by CVE-2026-114105?
How do I fix CVE-2026-114105?
No fix has been published for CVE-2026-114105 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-114105 being exploited?
There is no known exploitation of CVE-2026-114105 in the wild and no public exploit code.
Sources
Also known as GHSA-5mgq-mp28-q7x2, GHSA-qjf8-53jv-w9w6.