POC-CVE-2026-102282

CVE-2026-102282 — adm-zip setuid/setgid preservation during extraction Incorrect permission assignment in the npm package adm-zip. Extraction can keep setuid, setgid, and sticky bits from an untrusted zip when keepOriginalPermission is enabled, allowing a root-owned setuid executable to be plante...

kernel: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions

A flaw was found in the Linux kernel's Server Message Block SMB client. When a file with the setuid or setgid bit is written to on certain Common Internet File System CIFS mounts specifically those using 'cifsacl', 'modefromsid' options, or SMB3.1.1 POSIX extensions, the kernel fails to properly...

Security Bulletin: IBM® Db2® is vulnerable to buffer overflow in setgid helper db2flacc. (CVE-2026-10535)

Summary IBM® Db2® is vulnerable to buffer overflow in setgid helper db2flacc. Vulnerability Details CVEID:CVE-2026-10535 DESCRIPTION: IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to buffer overflow in setgid helper db2flacc. CWE:CWE-121: Stack-based Buffer Overflow CVSS...

CLEANSTART-2024-HI39153 On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits

Security vulnerability affects the go package. On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits...

kernel: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions

A flaw was found in the Linux kernel's Server Message Block SMB client. When a file with the setuid or setgid bit is written to on certain Common Internet File System CIFS mounts specifically those using 'cifsacl', 'modefromsid' options, or SMB3.1.1 POSIX extensions, the kernel fails to properly...

kernel: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions

A flaw was found in the Linux kernel's Server Message Block SMB client. When a file with the setuid or setgid bit is written to on certain Common Internet File System CIFS mounts specifically those using 'cifsacl', 'modefromsid' options, or SMB3.1.1 POSIX extensions, the kernel fails to properly...

ncurses: Fix of 2 CVEs

CVE-2021-39537: fix heap buffer overflow in nccaptoinfo with a crafted termcap entry - CVE-2023-29491: ignore terminfo/termcap environment variables in setuid/setgid programs --disable-root-environ...

kernel: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions

A flaw was found in the Linux kernel's Server Message Block SMB client. When a file with the setuid or setgid bit is written to on certain Common Internet File System CIFS mounts specifically those using 'cifsacl', 'modefromsid' options, or SMB3.1.1 POSIX extensions, the kernel fails to properly...

kernel: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions

A flaw was found in the Linux kernel's Server Message Block SMB client. When a file with the setuid or setgid bit is written to on certain Common Internet File System CIFS mounts specifically those using 'cifsacl', 'modefromsid' options, or SMB3.1.1 POSIX extensions, the kernel fails to properly...

CLSA-2026-1792806631 ncurses: Fix of 2 CVEs

CVE-2021-39537: fix heap buffer overflow in nccaptoinfo with a crafted termcap entry - CVE-2023-29491: ignore terminfo/termcap environment variables in setuid/setgid programs --disable-root-environ...

CVE-2026-114105

Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setgid, or sticky bits on extracted files when keepOriginalPermission is enabled. Attackers can craft zip external file attributes that pass unmasked into chmod, letting...

CVE-2026-114105

The Adm-zip library, in versions prior to 0.6.1 , is vulnerable to an incorrect permission assignment flaw when the keepOriginalPermission option is enabled. An attacker can craft malicious ZIP files with external file attributes that are passed unmasked into the chmod function. This allows the a...

CVE-2026-114105 Adm-zip before 0.6.1 Privilege Escalation via keepOriginalPermission Setuid Bits

Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setgid, or sticky bits on extracted files when keepOriginalPermission is enabled. Attackers can craft zip external file attributes that pass unmasked into chmod, letting...

CVE-2026-114105 Adm-zip before 0.6.1 Privilege Escalation via keepOriginalPermission Setuid Bits

Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setgid, or sticky bits on extracted files when keepOriginalPermission is enabled. Attackers can craft zip external file attributes that pass unmasked into chmod, letting...

CVE-2026-114105 Adm-zip before 0.6.1 Privilege Escalation via keepOriginalPermission Setuid Bits

Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setgid, or sticky bits on extracted files when keepOriginalPermission is enabled. Attackers can craft zip external file attributes that pass unmasked into chmod, letting...

EUVD-2026-106908

Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setgid, or sticky bits on extracted files when keepOriginalPermission is enabled. Attackers can craft zip external file attributes that pass unmasked into chmod, letting...

PT-2026-120231

Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setgid, or sticky bits on extracted files when keepOriginalPermission is enabled. Attackers can craft zip external file attributes that pass unmasked into chmod, letting...

Linux Distros Unpatched Vulnerability : CVE-2026-114105

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setgid, or sticky bits on extracted files wh...

Red Hat: CVE-2026-114105: adm-zip: adm-zip: Privilege escalation via unmasked permissions during archive extraction

Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setgid, or sticky bits on extracted files when keepOriginalPermission is enabled. Attackers can craft zip external file attributes that pass unmasked into chmod, letting...

Astra Linux – vulnerability in openssh

In OpenSSH versions prior to 10.3, a file downloaded via scp may be installed with setuid or setgid permissions—a behavior that goes against some users’ expectations—if the download is performed as root using -O legacy scp protocol and without -p preserve mode...