CLEANSTART-2026-NS20833 archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened

Security vulnerability affects the go1.27 package. archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened...

[SECURITY] Fedora 45 Update: ocaml-zip-1.14-5.fc45

This Objective Caml library provides easy access to compressed files in ZIP and GZIP format, as well as to Java JAR files. It provides functions for reading from and writing to compressed files in these formats...

PT-2026-106828

Name of the Vulnerable Software and Affected Versions ImageSharp versions 4.0.0 through 4.1.1 Description In the 2D graphics library, the ExrBaseDecompressor.UndoZipCompression function accepts a nonempty ZIP or ZIPS inflate result that is shorter than the required EXR block size. While...

PT-2026-106761

HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensions, or content is performed. An authenticated administrator can upload a crafte...

Linux Distros Unpatched Vulnerability : CVE-2026-102282

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm- zip applies the Unix permission bits stored in a zip...

WSO2-2021-1258

WSO2-2021-1258: Zip Slip vulnerability in WSO2 ESB A ZIP file based directory traversal Zip Slip vulnerability was identified in the WSO2 Management Console. Remote code execution may be obtained by writing/overwriting specific files. Vendor Disclosure: The vendor's disclosure and fix for this...

CVE-2026-102282

A flaw was found in adm-zip. This vulnerability allows privilege escalation when untrusted archives are extracted with original file permissions enabled. The library fails to filter out special Unix execution flags, such as setuid or setgid, from extracted files. If an administrative process...

CVE-2026-102282

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via fs.chmodSync when keepOriginalPermission=true is passed to extractAllTo/extractEntryTo — and it...

CVE-2026-102282 adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via fs.chmodSync when keepOriginalPermission=true is passed to extractAllTo/extractEntryTo — and it...

CVE-2026-102282

The adm-zip Node.js library (prior to 0.6.1 ) contains a vulnerability where it preserves SUID , SGID , and sticky bits from untrusted ZIP archives when the keepOriginalPermission=true flag is enabled. Specifically, the fileAttr property in headers/entryHeader.js uses an incorrect bitmask (0xfff)...

EUVD-2026-92493

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via fs.chmodSync when keepOriginalPermission=true is passed to extractAllTo/extractEntryTo — and it...

CVE-2026-102282 adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via fs.chmodSync when keepOriginalPermission=true is passed to extractAllTo/extractEntryTo — and it...

CVE-2026-102282 adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via fs.chmodSync when keepOriginalPermission=true is passed to extractAllTo/extractEntryTo — and it...

Astra Linux – Vulnerability in p7zip

7-Zip 22.01 does not report an error for certain invalid xz files that involve stream flags and reserved bits. Some later versions are unaffected...

Astra Linux – Vulnerability in Minzip

MiniZip in zlib version 1.3 has an integer overflow, resulting in a heap-based buffer overflow in zipOpenNewFileInZip464, which can occur due to a long filename, comment, or additional fields. NOTE: MiniZip is not a supported component of the zlib product. NOTE: pyminizip in versions 0.2.6 onward...

Astra Linux – Vulnerability in zziplib

A Stack Buffer Overflow vulnerability in zziplibv 0.13.77 allows attackers to cause a denial of service through the zzipFetchDiskTrailer function located in the /zzip/zip.c file...

Astra Linux – Vulnerability in p7zip

Ppmd7.c in 7-ZIP before 23.00 allows for integer underflow and invalid read operations due to a crafted 7Z archive...

Astra Linux – Vulnerability in p7zip

7-ZIP ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected 7-ZIP installations. Interaction with this product is required to exploit this vulnerability, but the attack vectors may vary depending ...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/zip – fixed a mismatch in operations on the sglsgenr variable. KASAN reported this bug as follows: 17619.659757 BUG: KASAN: Global-out-of-bounds condition in paramgetint+0x34/0x60. 17619.673193 A size 4 read was...

CVE-2026-102282: Incorrect Permission Assignment for Critical Resource

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via fs.chmodSync when keepOriginalPermission=true is passed to extractAllTo/extractEntryTo — and it...