I wrote a little shellscript that helps installing a web application. The script itself just downloads a zip archive, extracts it and changes the permissions of the extracted files to the one needed to run the webapp.
The problem now is that some users reported that after running my script, all the permissions of every file in their home directory or even on their whole computer changed to 000 (except the actual unzipped files which do have the correct permissions).
The only lines in my script actually doing IO are these:

URL="http://foo.com/"
FILENAME="some.zip"
curl --silent "$URL$FILENAME" -o $FILENAME > /dev/null
echo "Unzipping...\c"
if unzip -oqq $FILENAME > /dev/null
then
    chmod -R 777 app/tmp app/webroot app/Config/database* app/configuration*
    chown -R www:www *
    rm $FILENAME
    echo "\t\t\tOK"
    exit 0
else
    echo "\t\t\tERROR"
    exit 1
fi

I seriously can't explain this to myself. How can this even be possible?
It is entirely possible that the users accidentally ran the script in their home directory, but that still wouldn't explain why the permissions where set to 000, not www/777.