Live › vulnerability › CVE-2026-115908
Go to dashboardThe zip Rust crate, versions 7.2.0 through 8.x, validates symbolic link targets during extraction with a lexical prefix check instead of resolving intermediate links. An attacker who can supply a ZIP archive and knows or guesses the extraction directory can create or overwrite files outside that directory with the extracting process's privileges.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 17:31 UTC. All times on this page are UTC.
Rust applications that depend on the zip crate between 7.2.0 and 8.x and extract archives that an outside party can supply, such as uploads or downloaded files. Applications that only write archives, or that extract only trusted archives, are much less exposed. On Windows, the risk is higher when the process runs with SeCreateSymbolicLinkPrivilege, such as administrator rights or Developer Mode.
No product ranges from the sources yet.
zip crate in Cargo.lock (for example grep -A1 'name = "zip"' Cargo.lock) and see whether it is between 7.2.0 and 9.0.0ZipArchive::extract or extract_unwrapped_root_dir that handles archives from untrusted sourceszip crate to 9.0.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 7.2.0 until 9.0.0, ZipArchive::extract and ZipArchive::extract_unwrapped_root_dir use safe_prepare_path in src/read/zipfile.rs and simplified_components in src/path.rs to validate symbolic link targets with a lexical prefix comparison rather than resolving each intermediate link. An attacker who knows or can guess the absolute extraction destination can create a chain whose apparent target remains under the destination while an intermediate symlink resolves outside it, allowing attacker-controlled files to be created or overwritten with the extracting process's privileges. On Windows, discarded drive and UNC prefixes can permit a single-link escape when the process has SeCreateSymbolicLinkPrivilege, such as through administrator rights or Developer Mode. This regression is distinct from CVE-2025-29787. This issue is fixed in version 9.0.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-115908")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.