adm-zip versions prior to 0.6.1 have a vulnerability where extraction with the keepOriginalPermission=true flag preserves setuid/setgid bits from untrusted ZIP files. When extraction is performed as root, this can lead to local privilege escalation by creating root-owned setuid binaries that execute attacker-controlled code with elevated privileges.