---
id: "CVE-2026-115905"
kind: "vulnerability"
aliases: ["CVE-2026-115905"]
title: "Rust zip crate: streaming reader writes attacker-chosen paths, overwriting files"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cargo", "package", "rust", "zip"]
not_affected_if: ["no-untrusted-archives", "uses-ziparchive-only"]
published_at: "2026-10-26T17:17:17+00:00"
first_seen_at: "2026-10-26T17:31:22+00:00"
updated_at: "2026-10-26T17:33:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115905", "first_seen_at": "2026-10-26T17:31:22+00:00"}]
---

# Rust zip crate: streaming reader writes attacker-chosen paths, overwriting files

The Rust zip crate's ZipStreamReader extracts files using Local File Header names while ZipArchive uses Central Directory names, so a crafted archive can make a streaming extractor write a different path and content than a scanner inspecting the archive would see. An attacker can thereby overwrite files that a downstream service relies on.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the locked version of the `zip` crate in `Cargo.lock` (e.g. `grep -A1 'name = "zip"' Cargo.lock`); versions through `9.0.4` are affected
- Find code that uses `ZipStreamReader` from `src/read/stream.rs` to extract untrusted archives

## Fix

- Upgrade the `zip` crate to `9.0.5` or later
- Until upgraded, avoid `ZipStreamReader` for untrusted archives and use `ZipArchive` with validated paths

## Timeline

- 2026-10-26T17:31:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115905

## From the sources

zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in src/read/stream.rs. A crafted archive can therefore appear benign to a component that inspects the central directory but cause a streaming extractor to write a different attacker-selected path and content, potentially overwriting files used by a downstream service. This issue is fixed in version 9.0.5.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_