CVE-2026-114105

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-114105

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114105.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-114105

Aliases

GHSA-qjf8-53jv-w9w6

Published

2026-10-21T00:37:06Z

Modified

2026-10-21T10:45:46Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Adm-zip before 0.6.1 Privilege Escalation via keepOriginalPermission Setuid Bits

Details

Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setgid, or sticky bits on extracted files when keepOriginalPermission is enabled. Attackers can craft zip external file attributes that pass unmasked into chmod, letting attacker-controlled executables gain elevated privileges when extracted as root and later run.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-732"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114105.json"
}

References

Affected packages

Git / github.com/cthackers/adm-zip

Affected ranges

Type

GIT

Repo

https://github.com/cthackers/adm-zip

Events

Introduced

Fixed

cb2cf9ba4c7c865db426e2de1997cb41194d9872

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "0.6.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Affected versions

v0.*

v0.1.1

v0.1.2

v0.1.3

v0.1.5

v0.1.7

v0.1.8

v0.1.9

v0.2.1

v0.3.1

v0.3.2

v0.4.10

v0.4.11

v0.4.13

v0.4.14

v0.4.16

v0.4.3

v0.4.4

v0.4.5

v0.4.6

v0.4.7

v0.4.8

v0.4.9

v0.5.0

v0.5.1

v0.5.10

v0.5.11

v0.5.12

v0.5.13

v0.5.14

v0.5.15

v0.5.16

v0.5.17

v0.5.18

v0.5.2

v0.5.3

v0.5.4

v0.5.5

v0.5.6

v0.5.7

v0.5.8

v0.5.9

v0.6.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114105.json"