Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-115905: zip library can overwrite files and run code

CVE-2026-115905 · published 15 days ago

Summary

The Rust zip library (zip) up to version 9.0.4 can be tricked by a specially crafted ZIP file. The file appears safe when checked but extracts to a different location, allowing an attacker to replace important files and potentially execute code. Update the library to version 9.0.5 to fix the problem.

What to do

Update zip to version 9.0.5.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	zip-rs	zip2	< 9.0.5
Debian:12	debian	rust-zip	All versions
Ubuntu:20.04:LTS	canonical	rust-zip	All versions
rust	–	zip	<= 9.0.4 Fix: upgrade to 9.0.5
crates.io	–	zip	< 9.0.5 Fix: upgrade to 9.0.5

Original advisory text

zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE

zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in src/read/stream.rs. A crafted archive can therefore appear benign to a component that inspects the central directory but cause a streaming extractor to write a different attacker-selected path and content, potentially overwriting files used by a downstream service. This issue is fixed in version 9.0.5.

References

https://ubuntu.com/security/CVE-2026-115905 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-115905 Third Party Advisory
https://github.com/zip-rs/zip2/security/advisories/ghsa-m665-v7pm-7grj Third Party Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1152227 Third Party Advisory
https://security-tracker.debian.org/tracker/cve-2026-115905 Third Party Advisory
https://github.com/cveproject/cvelistv5/tree/main/cves/2026/115xxx/cve-2026-1159... Third Party Advisory
https://nvd.nist.gov/vuln/detail/cve-2026-115905 Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2026-115905 Vendor Advisory
https://github.com/advisories/GHSA-m665-v7pm-7grj
https://github.com/zip-rs/zip2 Product
https://github.com/zip-rs/zip2/commit/8068ab480ccf8daa7411424e365fcdbe6d09443e Patch
https://github.com/zip-rs/zip2/releases/tag/v9.0.5 URL
https://github.com/zip-rs/zip2/security/advisories/GHSA-m665-v7pm-7grj Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-1159... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-115905 Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

9.9 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-20Improper Input Validation

CWE-436Interpretation Conflict

Timeline

Published26 Oct 2026

Updated4 Nov 2026

First seen26 Oct 2026

Sources

CVE-2026-115905 · NVD

CVE-2026-115905 · MITRE

DEBIAN-CVE-2026-115905 · OSV

CVE-2026-115905 · OSV

GHSA-m665-v7pm-7grj · GHSA

UBUNTU-CVE-2026-115905 · OSV

GHSA-m665-v7pm-7grj · OSV

Track software like this

Free during beta