Bug 2545998 (CVE-2026-102282)

Summary: CVE-2026-102282 adm-zip: adm-zip: Privilege escalation via unfiltered permission bits in extracted archives
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: abarbaro, akhatavk, alizardo, aos-team-art-private, asdas, cdrage, cmyers, dnakabaa, dpaolell, dschmidt, gbenhaim, gmalinko, gparvin, ikhan, janstey, jbalunas, jchui, jdelft, jhe, jlanda, jupierce, kaycoth, kshier, ktsao, lcouzens, lgarciaa, mbiarnes, nboldt, niyer, oaljalju, pdelbell, ppalepu, ppostler, prdhamdh, psrna, rbobbitt, rhaigner, rhel-process-autobot, rstepani, rushinde, sghai, sidsharm, simaishi, stcannon, suppawar, tsze, twaugh, vlaad, watson-tool-maintainers, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in adm-zip. This vulnerability allows privilege escalation when untrusted archives are extracted with original file permissions enabled. The library fails to filter out special Unix execution flags, such as setuid or setgid, from extracted files. If an administrative process extracts a specially crafted archive, an attacker can place a binary that allows a local unprivileged user to execute code with administrative privileges.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-05 17:12:06 UTC 
adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via `fs.chmodSync()` when `keepOriginalPermission=true` is passed to `extractAllTo()`/`extractEntryTo()` — and it never filters the setuid/setgid/sticky bits out of those bits. A zip crafted by an attacker can therefore produce an extracted binary with mode `04755`. When extraction runs as root (the default posture in Docker builds, CI runners, and privileged install steps — the exact environments where this flag is used), the resulting root-owned setuid file is executed later by a lesser-privileged user, turning the attacker's code into a root execution. Version 0.6.1 fixes the issue.