The vulnerability in adm‑zip before version 0.6.1 allows privileged users to set setuid, setgid, or sticky bits on files extracted from a malicious ZIP archive when the keepOriginalPermission feature is enabled. By embedding external file attributes into the archive, the permission changes bypass the usual permission masking and are applied directly via chmod when extracted. If the process extracting the archive runs with elevated privileges, the resulting file may become a set‑uid executable, giving an attacker controlled binary the ability to run with root rights.

Adopted by the cthackers project, the adm‑zip library is affected in all releases earlier than 0.6.1. Systems that rely on any of these versions and perform ZIP extraction as a privileged user are vulnerable. The issue is not tied to a specific operating system but impacts any environment where adm‑zip is compiled and executed with administrator privileges.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score of less than 1 % suggests a low current probability of exploitation. Although the vulnerability is not currently listed in the CISA KEV catalog, it remains a potential escalation vector for attacks that combine privileged extraction with malicious code. The attack vector is local, requiring the attacker to supply a crafted archive to a process running as root or with set‑uid permissions.