This flaw in the Rust zip library allows a crafted archive to present a benign appearance in the central directory while the local file header contains a different, attacker‑selected file path. During extraction the library writes the file to the path derived from the local header, potentially overwriting critical files used by a downstream service. The resulting file overwrite can lead to arbitrary code execution, reflected in the CVSS score of 10 and the attribution to CWE‑20 (improper input validation) and CWE‑436 (inadequate reference checks).

The vulnerability affects the zip-rs:zip2 product in all releases up to version 9.0.4. Users running zip2 in any Rust application should upgrade to version 9.0.5 or later to eliminate the mismatch between the central directory and local file header metadata.

The flaw offers a straightforward file overwrite attack vector for any process that extracts archives with zip2. Attackers who can supply a malicious archive—either locally or via a network‑exposed service—can overwrite protected files and potentially achieve control of the application. With a CVSS score of 10 and no available EPSS data, the risk is considered critical, and the vulnerability is not yet listed in CISA's KEV catalog. The primary mitigation is to install the fixed release.