adm-zip CVE-2026-114105

Three concrete prerequisites must all hold: (1) the adm-zip keepOriginalPermission option must be explicitly enabled (non-default), causing stored external file attributes to be applied verbatim via chmod without masking setuid/setgid/sticky bits; (2) the extraction must run in a privileged context (as root) so the setuid/setgid bits confer meaningful elevation; and (3) the resulting attacker-controlled executable must subsequently be run. The attacker also needs to deliver a crafted zip whose external file attributes encode the special bits. Limiting factors: local attack vector, dependence on the non-default keepOriginalPermission setting, the need for root-context extraction, and a separate later execution step - each narrows realistic exploitability below the raw score.

Signals point to a real but conditional, medium-severity privilege-escalation issue rather than a top-priority emergency. The input CVSS 4.0 vector (AV:L/AC:L/PR:N/UI:N) scores 6.9 with an integrity-only impact (VI:H, VC:N, VA:N), which is consistent with CWE-732 incorrect permission assignment leading to setuid/setgid escalation - this is NOT an information-disclosure bug despite the 'Information Disclosure' tag (VC:N contradicts that tag). Exploitation status: no public exploit identified at time of analysis (no KEV listing and no POC referenced in the supplied data). No EPSS score or SSVC decision data was provided, so exploitation probability and automatability cannot be quantified from the input. The local attack vector and the dependence on a non-default library option plus a root-context extraction substantially limit real-world risk: this is a supply-chain/toolchain hazard that matters most where untrusted archives are extracted by privileged processes, not a broadly wormable network flaw. Treat as a dependency-hygiene patch priority rather than an incident-grade threat absent evidence of exploitation.

An attacker crafts a malicious zip whose external file attributes encode a setuid-root bit on an attacker-controlled executable, then gets a privileged (root) process using adm-zip with keepOriginalPermission enabled to extract it. The unmasked permission bits pass into chmod, so the extracted binary becomes setuid root; when that binary is later executed, the attacker gains root privileges. No public exploit code was identified in the provided data, and the local/config-dependent nature means delivery and the privileged extraction step must both be arranged.