CVE-2026-102282, CoreCVE

HIGH

adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation

Published Sep 29, 2026

7.1

HIGH

CVSS 3.1

adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation

Ecosystem	Package	Introduced	Fixed
npm	adm-zip	0	0.6.1

No remediation recorded yet.

Weaknesses (1)

CWE-732

Incorrect Permission Assignment

Link	Providers	Tags
https://github.com/advisories/GHSA-j5f4-cc29-5x44		Advisory
https://github.com/cthackers/adm-zip/commit/6a63c339b83c52915483efacda517660a7a7bf87
https://github.com/cthackers/adm-zip/releases/tag/v0.6.1
https://github.com/cthackers/adm-zip/security/advisories/GHSA-j5f4-cc29-5x44

No recorded changes yet.

Sources

Status n/a

Assigner n/a

Published Sep 29, 2026

Updated n/a

Reserved n/a

Updated n/a

Status n/a

Modified n/a

Severity n/a

Public date n/a