CVE-2026-114105: fallo de gravedad media en cthackers adm-zip
Adm-zip before 0.6.1 Privilege Escalation via keepOriginalPermission Setuid Bits
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.9epss 0.1%
Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setgid, or sticky bits on extracted files when keepOriginalPermission is enabled. Attackers can craft zip external file attributes that pass unmasked into chmod, letting attacker-controlled executables gain elevated privileges when extracted as root and later run.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Productos afectados
cthackers · adm-zipCVEs relacionadas — cthackers adm-zip
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-92000HIGHadm-zip 0.5.14 through 0.6.0 Denial of Service via Zero Declared Uncompressed SizeEPSS 0.7%CVE-2026-77301HIGHadm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)EPSS 0.6%CVE-2026-114102HIGHadm-zip before 0.6.1 Denial of Service via inflateAsync Unhandled Error EventEPSS 0.5%CVE-2026-114103MEDIUMadm-zip 0.6.0 Decompression Bomb Guard Bypass via getDataAsync()EPSS 0.4%CVE-2026-114104HIGHadm-zip before 0.6.1 Duplicate ZIP Entry Name Validation BypassEPSS 0.3%CVE-2026-116137MEDIUMadm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent NamesEPSS 0.3%