CVE-2026-115905

zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE

View on CVE.org

Published Oct 26, 2026 CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Description

zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in src/read/stream.rs. A crafted archive can therefore appear benign to a component that inspects the central directory but cause a streaming extractor to write a different attacker-selected path and content, potentially overwriting files used by a downstream service. This issue is fixed in version 9.0.5.

Analysis

Technical impact

This flaw in the zip library allows a crafted archive to present a benign appearance in the central directory while the local file header contains a different, attacker‑selected file path. When extracted, the library writes the file to the path derived from the local header, potentially overwriting critical files used by a downstream service. The result is an arbitrary file overwrite that can lead to remote code execution. The vulnerability falls under CWE-1288, reflecting the incorrect handling of duplicated metadata that leads to insecure file operations.

Affected Systems

The vulnerability affects zip-rs:zip2 product in all releases up to version 9.0.4. Users running zip2 in any Rust application should upgrade to version 9.0.5 or later to eliminate the mismatch between the central directory and local file header metadata.

Risk and Exploitability

The flaw offers a straightforward file overwrite attack vector for any process that extracts archives with zip2. Attackers who can supply a malicious archive—either locally or via a network‑exposed service—can overwrite protected files and potentially achieve control of the application. With a CVSS score of 10 and an EPSS score of < 1%, the risk is considered critical, and the vulnerability is not yet listed in CISA's KEV catalog. The primary mitigation is to install the fixed release.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

zip-rs

zip2

affected

Version	Status	Constraints
`< 9.0.5`	affected	—

No data.

Vendor Product Versions

Zip-rs

Zip2

Version	Status	Scheme	Platform
`[0,9.0.5)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the zip-rs:zip2 library to version 9.0.5 or later.
Restrict the extraction of archives to trusted sources only, and reject archives that contain path traversal or non‑rooted paths.
Validate extracted file paths against a whitelist of allowed directories before writing them to disk.

Generated by OpenCVE AI on November 4, 2026 at 07:28 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-m665-v7pm-7grj	zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact Low

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.320% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact total

References

Link	Providers
https://github.com/zip-rs/zip2/commit/8068ab480ccf8daa7411424e365fcdbe6d09443e
https://github.com/zip-rs/zip2/releases/tag/v9.0.5
https://github.com/zip-rs/zip2/security/advisories/GHSA-m665-v7pm-7grj
https://nvd.nist.gov/vuln/detail/CVE-2026-115905
https://www.cve.org/CVERecord?id=CVE-2026-115905

History

Nov 4, 2026 12:30 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-1288
References		https://nvd.nist.gov/vuln/detail/CVE-2026-115905 https://www.cve.org/CVERecord?id=CVE-2026-115905
Metrics	threat_severity `None`	cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Critical`

Nov 2, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Oct 26, 2026 7:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Zip-rs Zip-rs zip2
Vendors & Products		Zip-rs Zip-rs zip2

Oct 26, 2026 4:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in src/read/stream.rs. A crafted archive can therefore appear benign to a component that inspects the central directory but cause a streaming extractor to write a different attacker-selected path and content, potentially overwriting files used by a downstream service. This issue is fixed in version 9.0.5.
Title		zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE
Weaknesses		CWE-20 CWE-436
References		https://github.com/zip-rs/zip2/commit/8068ab480ccf8daa7411424e365fcdbe6d09443e https://github.com/zip-rs/zip2/releases/tag/v9.0.5 https://github.com/zip-rs/zip2/security/advisories/GHSA-m665-v7pm-7grj
Metrics		cvssV4_0 `{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L'}`