CVE-2026-114105

The Adm-zip library, in versions prior to 0.6.1 , is vulnerable to an incorrect permission assignment flaw when the keepOriginalPermission option is enabled. An attacker can craft malicious ZIP files with external file attributes that are passed unmasked into the chmod function. This allows the a...

EUVD-2026-106908

Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setgid, or sticky bits on extracted files when keepOriginalPermission is enabled. Attackers can craft zip external file attributes that pass unmasked into chmod, letting...

adm-zip_LPE-PoC

CVE-2026-102282: adm-zip Local Privilege Escalation via SUID Preservation Description adm-zip is an established, pure-JavaScript ZIP archive library for Node.js with over 20 million weekly downloads across the npm ecosystem. It is widely integrated into CI/CD pipelines, container build workflows,...

POC-CVE-2026-102282

CVE-2026-102282 — adm-zip setuid/setgid preservation during extraction Incorrect permission assignment in the npm package adm-zip. Extraction can keep setuid, setgid, and sticky bits from an untrusted zip when keepOriginalPermission is enabled, allowing a root-owned setuid executable to be plante...

CVE-2026-102282

The adm-zip Node.js library (prior to 0.6.1 ) contains a vulnerability where it preserves SUID , SGID , and sticky bits from untrusted ZIP archives when the keepOriginalPermission=true flag is enabled. Specifically, the fileAttr property in headers/entryHeader.js uses an incorrect bitmask (0xfff)...

EUVD-2026-92493

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via fs.chmodSync when keepOriginalPermission=true is passed to extractAllTo/extractEntryTo — and it...

CVE-2026-102282 adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via fs.chmodSync when keepOriginalPermission=true is passed to extractAllTo/extractEntryTo — and it...

CVE-2026-102282 adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via fs.chmodSync when keepOriginalPermission=true is passed to extractAllTo/extractEntryTo — and it...

Exploit for CVE-2026-102282

CVE-2026-102282 — adm-zip setuid/setgid preservation during ex...

adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation

Summary adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via fs.chmodSync when keepOriginalPermission=true is passed to extractAllTo/extractEntryTo — and it never filters the setuid/setgid/sticky bits out of those bits. A zip crafted by an attacker can...

GHSA-J5F4-CC29-5X44 adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation

Summary adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via fs.chmodSync when keepOriginalPermission=true is passed to extractAllTo/extractEntryTo — and it never filters the setuid/setgid/sticky bits out of those bits. A zip crafted by an attacker can...

Incorrect Permission Assignment for Critical Resource

Overview adm-zip is a JavaScript implementation for zip data compression for NodeJS. Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource via the fileAttr getter in headers/entryHeader.js, which preserves attacker-controlled Unix special...