adm-zip_LPE-PoC

CVE-2026-102282: adm-zip における SUID 保持によるローカル権限昇格 概要 adm-zip は Node.js 向けの定評ある純 JavaScript 製 ZIP アーカイブライブラリであり、npm エコシステム全体で週間 2,000 万回以上ダウンロードされています。CI/CD パイプライン、コンテナビルドワークフロー、クラウドデプロイツール、サーバーサイドアプリケーションなどに広く統合され、アーカイブの圧縮および展開を処理しています。 展開時、adm-zip はアーカイブに記録された POSIX パーミッションを復元するための...

Updated fuse-overlayfs package fixes security vulnerabilities

fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/openOTRUNC. CVE-2026-52791 Operations on hardlinked lower-layer files resolving to the wrong layer. CVE-2026-77478...

MGASA-2026-0462 Updated fuse-overlayfs package fixes security vulnerabilities

fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/openOTRUNC. CVE-2026-52791 Operations on hardlinked lower-layer files resolving to the wrong layer. CVE-2026-77478...

adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation

Summary adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via fs.chmodSync when keepOriginalPermission=true is passed to extractAllTo/extractEntryTo — and it never filters the setuid/setgid/sticky bits out of those bits. A zip crafted by an attacker can...

NPM: adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation

NPM: adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs - local privilege escalation vulnerability discovered by ? in WordPress Npm adm-zip versions = 0.6.0...

SUSE SLES15 Security Update : fuse-overlayfs (SUSE-SU-2026:4026-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4026-1 advisory. This update for fuse-overlayfs fixes the following issue: - CVE-2026-52791: Privilege Escalation Vulnerability via SUID/SGID Bit Preservatio...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fixed a reference leak in the GID entry when the createah operation fails. If the AH create request fails, the sgidattr should be released to avoid a reference leak during the release of the GID table...

Astra Linux – Vulnerability in Linux, Linux 5.10

A vulnerability was discovered in the fs/inode.c:inodeinitowner function logic of the Linux kernel. This vulnerability allows local users to create files for the XFS file system with unintended group ownership, along with group execution and SGID permission bits set. This occurs in a scenario whe...

openSUSE 16 Security Update : fuse-overlayfs (openSUSE-SU-2026:21753-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21753-1 advisory. This update for fuse-overlayfs fixes the following issue: - CVE-2026-52791: privilege escalation due to SUID/SGID bit preservation after truncate...

Security update for fuse-overlayfs (moderate)

openSUSE security update: security update for fuse-overlayfs ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21753-1 Rating: moderate References: bsc1273100 Cross-References: CVE-2026-52791 CVSS scores: CVE-2026-52791 SUSE : 4.7...

Security update for fuse-overlayfs

This update for fuse-overlayfs fixes the following issue: CVE-2026-52791: Privilege Escalation Vulnerability via SUID/SGID Bit Preservation bsc1273100. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

SUSE-SU-2026:4026-1 Security update for fuse-overlayfs

This update for fuse-overlayfs fixes the following issue: - CVE-2026-52791: Privilege Escalation Vulnerability via SUID/SGID Bit Preservation bsc1273100...

OPENSUSE-SU-2026:21753-1 Security update for fuse-overlayfs

This update for fuse-overlayfs fixes the following issue: - CVE-2026-52791: privilege escalation due to SUID/SGID bit preservation after truncate operation bsc1273100...

SUSE-SU-2026:23469-1 Security update for fuse-overlayfs

This update for fuse-overlayfs fixes the following issue: - CVE-2026-52791: privilege escalation due to SUID/SGID bit preservation after truncate operation bsc1273100...

SUSE-SU-2026:23618-1 Security update for fuse-overlayfs

This update for fuse-overlayfs fixes the following issue: - CVE-2026-52791: privilege escalation due to SUID/SGID bit preservation after truncate operation bsc1273100...

SUSE-SU-2026:23252-1 Security update for fuse-overlayfs

This update for fuse-overlayfs fixes the following issue: - CVE-2026-52791: Privilege Escalation Vulnerability via SUID/SGID Bit Preservation bsc1273100...

CVE-2026-53612

A flaw was found in util-linux. When an /etc/fstab entry uses the user option together with X-mount.owner, X-mount.group, or X-mount.mode, mount8 changes ownership or permissions on the mount target after mounting without re-verifying the path. A local unprivileged user can exploit this...

AZL-94145 CVE-2026-52791 affecting package fuse-overlayfs 1.14-1

fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during openOTRUNC and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with...

CVE-2026-52791

fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during openOTRUNC and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with...

CVE-2026-52791 fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/open(O_TRUNC)

fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during openOTRUNC and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with...