Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-115908— zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (The defense against CVE-2025-29787 was broken in v7.2.0)

Quick assessment

Affected
zip-rs zip2
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

是一个用于 Rust 的 ZIP 库，支持读取和写入简单的 ZIP 文件。在 7.2.0 到 9.0.0 版本中， 和 方法在 中使用了 ，并在 中使用了 ，通过词法前缀比较来验证符号链接的目标，而非解析每个中间链接。如果攻击者知晓或能够推测出绝对提取目标路径，便可构造一条链接链，使其表观目标看似位于目标目录内，而中间某个符号链接却解析到该目录之外，从而在提取过程中以提取进程的权限创建或覆盖攻击者控制的文件。在 Windows 系统上，若进程拥有 （例如通过管理员权限或开发者模式），丢弃驱动器盘符和 UNC 前缀可

CVSS 7.4 · High EPSS 0.43% · P37

Possible ATT&CK Techniques 2 AI

T1566 · Phishing T1587.001 · Malware

Affected Version Matrix 1

VendorProduct Version RangeStatus
zip-rs zip2 >= 7.2.0, < 9.0.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-115908

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (The defense against CVE-2025-29787 was broken in v7.2.0)
Source: CVE Program / CVE List V5
Vulnerability Description
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 7.2.0 until 9.0.0, ZipArchive::extract and ZipArchive::extract_unwrapped_root_dir use safe_prepare_path in src/read/zipfile.rs and simplified_components in src/path.rs to validate symbolic link targets with a lexical prefix comparison rather than resolving each intermediate link. An attacker who knows or can guess the absolute extraction destination can create a chain whose apparent target remains under the destination while an intermediate symlink resolves outside it, allowing attacker-controlled files to be created or overwritten with the extracting process's privileges. On Windows, discarded drive and UNC prefixes can permit a single-link escape when the process has SeCreateSymbolicLinkPrivilege, such as through administrator rights or Developer Mode. This regression is distinct from CVE-2025-29787. This issue is fixed in version 9.0.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
zip-rs zip2 >= 7.2.0, < 9.0.0 -

II. Public POCs for CVE-2026-115908

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-115908

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-115908 (1)

Same Patch Batch · zip-rs · 2026-10-26 · 5 CVEs total

CVE-2026-115905 10.0 CRITICAL zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencie
CVE-2026-115909 7.5 HIGH zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction
CVE-2026-115907 7.5 HIGH zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP6
CVE-2026-115906 6.5 MEDIUM zip: AES Entry HMAC Authentication Bypass on Premature EOF

IV. Related Vulnerabilities

Same product: zip2
Same vendor: zip-rs
Same weakness: CWE-22