CVE-2026-114105: adm-zip 0 to before 0.6.1

Affected technology

adm-zip · 0 to before 0.6.1
cthackers

Description’s affected range: before 0.6.1

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Local · No privileges required · No user interaction required

What an attacker can do

Attackers can craft zip external file attributes that pass unmasked into chmod, letting attacker-controlled executables gain elevated privileges when extracted as root and later run. Vendor/CNA’s CVSS 4.0 assessment (base score 6.9/10) rates confidentiality and availability impact as none; integrity impact as high.