---
id: "CVE-2026-115908"
kind: "vulnerability"
aliases: ["CVE-2026-115908"]
title: "zip Rust crate: symlink extraction check lets files escape destination"
severity: "high"
cvss: 7.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cargo", "package", "rust", "zip"]
not_affected_if: ["archives-trusted-only", "no-extraction", "versions-outside-range"]
published_at: "2026-10-26T17:17:18+00:00"
first_seen_at: "2026-10-26T17:31:22+00:00"
updated_at: "2026-10-26T17:33:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115908", "first_seen_at": "2026-10-26T17:31:22+00:00"}]
---

# zip Rust crate: symlink extraction check lets files escape destination

The zip Rust crate, versions 7.2.0 through 8.x, validates symbolic link targets during extraction with a lexical prefix check instead of resolving intermediate links. An attacker who can supply a ZIP archive and knows or guesses the extraction directory can create or overwrite files outside that directory with the extracting process's privileges.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the locked version of the `zip` crate in `Cargo.lock` (for example `grep -A1 'name = "zip"' Cargo.lock`) and see whether it is between `7.2.0` and `9.0.0`
- Find code calling `ZipArchive::extract` or `extract_unwrapped_root_dir` that handles archives from untrusted sources

## Fix

- Upgrade the `zip` crate to `9.0.0` or later
- Until upgraded, do not extract untrusted archives with these functions

## Timeline

- 2026-10-26T17:31:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115908

## From the sources

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 7.2.0 until 9.0.0, ZipArchive::extract and ZipArchive::extract_unwrapped_root_dir use safe_prepare_path in src/read/zipfile.rs and simplified_components in src/path.rs to validate symbolic link targets with a lexical prefix comparison rather than resolving each intermediate link. An attacker who knows or can guess the absolute extraction destination can create a chain whose apparent target remains under the destination while an intermediate symlink resolves outside it, allowing attacker-controlled files to be created or overwritten with the extracting process's privileges. On Windows, discarded drive and UNC prefixes can permit a single-link escape when the process has SeCreateSymbolicLinkPrivilege, such as through administrator rights or Developer Mode. This regression is distinct from CVE-2025-29787. This issue is fixed in version 9.0.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_