Vulnerability details
CVE-2026-115905
zip-rs zip2
zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE
CVSS 4.0
10.0Critical
Official description
zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in src/read/stream.rs. A crafted archive can therefore appear benign to a component that inspects the central directory but cause a streaming extractor to write a different attacker-selected path and content, potentially overwriting files used by a downstream service. This issue is fixed in version 9.0.5.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 10.0Critical | 4.0 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| zip-rs | zip2 | < 9.0.5 | CVEProject cvelistV5 (CNA) |
References and advisories
3- https://github.com/zip-rs/zip2/commit/8068ab480ccf8daa7411424e365fcdbe6d09443e x_refsource_MISC
- https://github.com/zip-rs/zip2/releases/tag/v9.0.5 x_refsource_MISC
- https://github.com/zip-rs/zip2/security/advisories/GHSA-m665-v7pm-7grj x_refsource_CONFIRM
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-10-26
- Last updated
- 2026-11-02
- State
- Published
- Assigner (CNA)
- GitHub_M
- Kolun priority
- 21 · Low
Exploit prediction (EPSS)
0.32%
Probability of exploitation in 30 days
25.1%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- Proof of concept
- Technical impact
- Total
Weaknesses (CWE)
- CWE-20Improper Input Validation
- CWE-436Interpretation Conflict