Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-115905— zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE

Quick assessment

Affected
zip-rs zip2
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

zip 是 Rust 生态中用于读写简单 ZIP 文件的库。在 9.0.4 及更早版本中，ZipArchive 将中央目录文件头中的文件名视为权威来源，而 ZipStreamReader 在提取时却使用本地文件头中的文件名，且未在 src/read/stream.rs 中对这两处重复的元数据进行协调。因此，攻击者可构造恶意 ZIP 归档，使其在检查中央目录的组件看来是良性的，但在使用流式提取的组件中却会写入攻击者指定的不同路径和内容，从而可能覆盖下游服务所使用的文件。该问题已在版本 9.0.5 中修复。

CVSS 10.0 · Critical
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-115905

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE
Source: CVE Program / CVE List V5
Vulnerability Description
zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in src/read/stream.rs. A crafted archive can therefore appear benign to a component that inspects the central directory but cause a streaming extractor to write a different attacker-selected path and content, potentially overwriting files used by a downstream service. This issue is fixed in version 9.0.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
zip-rs zip2 < 9.0.5 -

II. Public POCs for CVE-2026-115905

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-115905

请登录查看更多情报信息。

Vendor Pages for CVE-2026-115905 (1)

Same Patch Batch · zip-rs · 2026-10-26 · 5 CVEs total

CVE-2026-115909 7.5 HIGH zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction
CVE-2026-115907 7.5 HIGH zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP6
CVE-2026-115908 7.4 HIGH zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract va
CVE-2026-115906 6.5 MEDIUM zip: AES Entry HMAC Authentication Bypass on Premature EOF

IV. Related Vulnerabilities

Same product: zip2
Same vendor: zip-rs
Same weakness: CWE-20