CVE-2026-114105: medium-severity vulnerability in cthackers adm-zip
Adm-zip before 0.6.1 Privilege Escalation via keepOriginalPermission Setuid Bits
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.9epss 0.1%
Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setgid, or sticky bits on extracted files when keepOriginalPermission is enabled. Attackers can craft zip external file attributes that pass unmasked into chmod, letting attacker-controlled executables gain elevated privileges when extracted as root and later run.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
cthackers · adm-zipRelated CVEs — cthackers adm-zip
In the same product, most dangerous first.
CVE-2026-92000HIGHadm-zip 0.5.14 through 0.6.0 Denial of Service via Zero Declared Uncompressed SizeEPSS 0.7%CVE-2026-77301HIGHadm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)EPSS 0.6%CVE-2026-114102HIGHadm-zip before 0.6.1 Denial of Service via inflateAsync Unhandled Error EventEPSS 0.5%CVE-2026-114103MEDIUMadm-zip 0.6.0 Decompression Bomb Guard Bypass via getDataAsync()EPSS 0.4%CVE-2026-114104HIGHadm-zip before 0.6.1 Duplicate ZIP Entry Name Validation BypassEPSS 0.3%CVE-2026-116137MEDIUMadm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent NamesEPSS 0.3%