Live › vulnerability › CVE-2026-115905
Go to dashboardThe Rust zip crate's ZipStreamReader extracts files using Local File Header names while ZipArchive uses Central Directory names, so a crafted archive can make a streaming extractor write a different path and content than a scanner inspecting the archive would see. An attacker can thereby overwrite files that a downstream service relies on.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 17:31 UTC. All times on this page are UTC.
Applications written in Rust that use the zip crate's streaming reader (ZipStreamReader) to extract ZIP archives that come from untrusted sources. Code that only uses ZipArchive for reading, or that never processes untrusted archives, is less exposed. Teams that do not build Rust software can skip it.
No product ranges from the sources yet.
zip crate in Cargo.lock (e.g. grep -A1 'name = "zip"' Cargo.lock); versions through 9.0.4 are affectedZipStreamReader from src/read/stream.rs to extract untrusted archiveszip crate to 9.0.5 or laterZipStreamReader for untrusted archives and use ZipArchive with validated pathsEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in src/read/stream.rs. A crafted archive can therefore appear benign to a component that inspects the central directory but cause a streaming extractor to write a different attacker-selected path and content, potentially overwriting files used by a downstream service. This issue is fixed in version 9.0.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-115905")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.