# CVE-2026-102282: adm-zip permission bit extraction privilege escalation

Source: https://junglewise.ai/threats/cve-2026-102282-adm-zip-extraction-preserves-suid-sgid-bits-from-untrusted-zips  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-102282 · Severity: high · CVSS 7.1 · Published 2026-10-05

adm-zip, a Node.js library for reading and writing ZIP files, fails to filter special permission bits (setuid, setgid, sticky) when extracting archives with the keepOriginalPermission flag enabled. An attacker can craft a malicious ZIP file containing a binary with setuid bits set; when extracted by root (common in Docker builds and CI pipelines), this produces a root-owned executable that executes with elevated privileges when run by an unprivileged user later, enabling arbitrary privilege escalation.

Technologies: [adm-zip (npm)](https://junglewise.ai/threats/technologies/adm-zip). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-102282 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102282 being exploited in the wild.

**How severe is CVE-2026-102282?** High severity, with a CVSS score of 7.1, published 5 October 2026.

**Which products and versions are affected?** Adm-Zip 0.6.0 and earlier; adm-zip (npm) <= 0.6.0, SEMVER:introduced=0,fixed=0.6.1.

**Is there a fix for CVE-2026-102282?** Yes. adm-zip (npm): upgrade to 0.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-102282 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-102282?** Check whether you run Adm-Zip or adm-zip (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- adm-zip (npm): upgrade to 0.6.1 or later

  ```sh
  npm install adm-zip@0.6.1
  ```


## Technical details

The vulnerability is a permission assignment flaw (CWE-732) in the fileAttr getter and extraction logic. When keepOriginalPermission=true, the library applies Unix mode bits directly from the ZIP entry header without masking out setuid (0o4000), setgid (0o2000), and sticky (0o1000) bits. An attacker-supplied ZIP can encode 0o4755 in the external file attributes; extraction as root creates a setuid binary that gains root privileges when executed by an unprivileged user. The fix is a one-line change to mask fileAttr with 0o777 instead of 0xfff.

## Affected products

- adm-zip adm-zip 0.6.0 and earlier

## Identifiers

- CVE-2026-102282
- GHSA-j5f4-cc29-5x44

## Timeline

- 2026-09-29: disclosed: Advisory published

## Related threats

- [Adm-zip incorrect permission assignment with keepOriginalPermission](https://junglewise.ai/threats/cve-2026-114105-adm-zip-before-0-6-1-contains-an-incorrect-permission-assignment)
- [adm-zip duplicate ZIP entry name validation bypass](https://junglewise.ai/threats/adm-zip-duplicate-zip-entry-names-getentry-and-extractallto-resolve-to-42f08f8e)
- [adm-zip getDataAsync() decompression bomb bypass](https://junglewise.ai/threats/adm-zip-getdataasync-bypasses-the-maxoutputlength-size-guard-enforced-3e032cd1)
- [adm-zip async decompression denial of service](https://junglewise.ai/threats/adm-zip-unhandled-error-event-in-async-deflate-decompression-crashes-337da7e4)
- [adm-zip uncontrolled memory allocation via uncompressed size](https://junglewise.ai/threats/cve-2026-77301-adm-zip-uncontrolled-memory-allocation-via-uncompressed-size)