CVE-2026-114105: Incorrect Permission Assignment for Critical Resource in cthackers adm-zip

The adm-zip library versions prior to 0.6.1 contain an incorrect permission assignment vulnerability. When the keepOriginalPermission feature is enabled, attackers can craft zip files with external file attributes that are passed unfiltered to the chmod system call. This allows setting of setuid, setgid, or sticky bits on extracted files. If such files are executables and extracted by a root user, they can gain elevated privileges when executed, leading to potential privilege escalation.

Attackers can create zip archives that, when extracted with keepOriginalPermission enabled by a privileged user (e.g., root), result in files with elevated permission bits (setuid, setgid, sticky). This can lead to privilege escalation on the host system if attacker-controlled executables are run with these elevated permissions.

Upgrade adm-zip to version 0.6.1 or later where this vulnerability is fixed. Until then, avoid enabling the keepOriginalPermission option when extracting untrusted zip files, especially when running with elevated privileges. No official patch link was provided, but the fixed version is 0.6.1.