CVE-2026-102282

A flaw was found in adm-zip. This vulnerability allows privilege escalation when untrusted archives are extracted with original file permissions enabled. The library fails to filter out special Unix execution flags, such as setuid or setgid, from extracted files. If an administrative process extracts a specially crafted archive, an attacker can place a binary that allows a local unprivileged user to execute code with administrative privileges.

A local privilege escalation flaw rated IMPORTANT by Red Hat was found in the adm-zip JavaScript library, which is bundled by several Red Hat products for creating and extracting ZIP archives. When extracting a ZIP archive with the keepOriginalPermission option enabled, adm-zip applies the Unix permission bits stored in the archive entry to the extracted file without filtering out the setuid and setgid bits. An attacker who can supply a specially crafted archive to an application or process that extracts it with this option enabled, for example a build, CI, or installation step running with administrative privileges, can cause a binary with the setuid bit set to be written to disk. If a local unprivileged user subsequently executes that file, the attacker's code runs with administrative privileges, resulting in a full compromise of the confidentiality and integrity of the affected host. Red Hat rates this flaw with a CVSS 3.1 score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), consistent with the upstream severity. Fixes for affected Red Hat product streams, including OpenShift Container Platform and community Fedora and EPEL components, are being pursued through the responsible product teams. Red Hat Enterprise Linux is not affected because the vulnerable adm-zip code is not present in the shipped gjs packages, and in the JBoss Fuse 7 ELS stream the vulnerable code is not in an executable path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

When extracting archives from untrusted sources with adm-zip, do not enable the keepOriginalPermission option in extractAllTo()/extractEntryTo(); the vulnerable permission-preservation behavior is only invoked when this option is enabled. The upstream project has released a version that filters the setuid/setgid bits from extracted permission metadata, so updating adm-zip to a version that includes this fix, when made available through Red Hat product channels, resolves the issue.