If an archive is processed by a privileged user (such as a root-level build pipeline, Docker build, or administrative installer), an attacker can craft a ZIP file containing an entry with SUID bits set. Upon extraction, the resulting file will be owned by root with the SUID bit enabled. If this file is later accessible and executed by a lesser-privileged user, the attacker's code will run with elevated (root) privileges. This behavior represents a form of local privilege escalation facilitated by insecure archive processing.

Attack Chain

1. Attacker crafts a malicious ZIP archive where an entry's external_attr is set to include the SUID bit (e.g., 04755).
2. The attacker delivers the archive to the target system (e.g., via upload endpoint, malicious build dependency, or project artifact).
3. The victim application or automated build system invokes adm-zip with keepOriginalPermission=true to extract the archive.
4. The extraction process, running with root privileges, calls fs.chmodSync() using the attacker-controlled mode bits.
5. The library writes the file to the filesystem, resulting in a root-owned file with the SUID bit set.
6. The SUID binary is moved or preserved through deployment artifacts (e.g., via cp -a or rsync).
7. An unprivileged user or service account executes the malicious binary.
8. The binary executes with root privileges, successfully achieving local privilege escalation.

Impact

Successful exploitation leads to full local privilege escalation on systems where the library is used to handle untrusted archives under high-privilege execution contexts (e.g., root). This is particularly relevant in CI/CD pipelines and automated deployment workflows. The vulnerability is tracked as CVE-2026-102282.

Recommendation

1. Upgrade the adm-zip dependency to a version where this permission bit filtering issue is remediated (note: if a patch is not yet available, avoid using the keepOriginalPermission flag when extracting untrusted ZIP archives).
2. Audit CI/CD pipelines and deployment scripts that use adm-zip to ensure that extraction does not occur under root privileges, or that source archives are verified via cryptographic signatures before extraction.
3. Use static analysis or custom instrumentation to identify code paths where adm-zip is invoked with keepOriginalPermission=true on externally sourced data.

An attacker can bypass this protection by crafting a malicious ZIP archive where the declared uncompressed size field in the local file header and central directory is set to exactly 0. Because the condition expectedLength > 0 fails, the maxOutputLength option is omitted, causing the library to default to zlib's internal limits rather than the intended application-level cap. This allows a small, highly compressed payload to expand into a significantly larger buffer in memory, leading to potential denial-of-service via OOM (Out-of-Memory) conditions.

Attack Chain

1. Attacker generates a highly redundant file to achieve high compression ratios (e.g., repeating bytes).
2. Attacker compresses this file using the DEFLATE algorithm.
3. Attacker modifies the ZIP archive structure to set both the local file header and central directory 'uncompressed size' fields to 0.
4. Attacker delivers the malicious ZIP archive to a target application using adm-zip.
5. The target application passes the untrusted ZIP to new AdmZip(buffer).
6. The application calls .getData(), .readFile(), or similar extraction methods on the malicious entry.
7. The adm-zip library ignores the maxOutputLength constraint due to the 0-value size field.
8. Zlib decompresses the full payload into memory, resulting in excessive resource consumption and potential process termination.

Impact

The vulnerability affects any application using adm-zip to process untrusted archives, such as web upload handlers, CI/CD artifact extractors, or email gateway scanners. Successful exploitation can lead to process crashes and denial-of-service by consuming disproportionate amounts of server memory, bypassing the intended safety guards implemented against decompression bombs.

Recommendation

• Upgrade the adm-zip package to a version that implements unconditional maxOutputLength enforcement or adds an independent compression-ratio verification mechanism.
• Until an upgrade is available, implement a wrapper around adm-zip functions that validates the actual size of the output buffer against a strict absolute ceiling before returning it to the application logic.
• Monitor logs for unusual memory spikes or process crashes associated with ZIP processing modules.