Zero Radar
← feed
CriticalVulnerabilityCVE-2026-115905updated 28 Oct 2026, 21:10 UTC

zip Rust library can be tricked into writing files to attacker-chosen paths

A specially crafted ZIP file can look harmless to a security scanner but, when extracted by a streaming tool, write a different malicious file over a real file on the server. The attacker can replace scripts or programs that the service rel

Fixed in 9.0.5Official, 2 sources
SeverityCriticalCVSS 10 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yes9.0.5 · since 26 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Crafted archiveHeaders name two different files
  2. 2Scanner approves itScanner reads central directory name
  3. 3Streaming extractExtractor uses local header name
  4. 4Wrong file writtenAttacker file overwrites a real one
  5. ResultAttacker plants a backdoor and disrupts service

What happened

In the Rust zip crate up to 9.0.4, ZipArchive reads filenames from the Central Directory while ZipStreamReader extracts using Local File Header names without reconciling them, creating a parser differential that enables path and content substitution.

Why it is dangerous: Attackers can bypass upload scanners and overwrite files used by a downstream service, potentially planting a backdoor and disrupting the service; the advisory rates it critical (CVSS 10).

Are you affected?

You are affected if your application uses the Rust zip crate version 9.0.4 or earlier and extracts untrusted archives with ZipStreamReader, especially where a different component inspects them with ZipArchive.

Package / productAffected versionsFixed in
zip · rust<= 9.0.49.0.5

What to do

  1. Update the zip crate to version 9.0.5 or later
  2. Re-check any archive-processing code that uses ZipStreamReader on untrusted input
  3. Ensure extraction runs with limited filesystem permissions and does not write over service-critical files

Timeline

  1. 26 Oct 2026, 17:17 UTC
    Publicly disclosed
  2. 26 Oct 2026, 17:17 UTC
    Reported by NVD · NVD
  3. 26 Oct 2026, 17:21 UTC
    Picked up by Zero Radar
  4. 28 Oct 2026, 21:10 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 28 Oct 2026, 21:10 UTC
    Fixed version published: zip 9.0.5 · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-115905 · GHSA-m665-v7pm-7grj
CVSS
10 / 10
EPSS
0.3% chance of exploitation within 30 days
Disclosed
26 Oct 2026, 17:17 UTC
On Zero Radar
26 Oct 2026, 17:21 UTC (5 min after disclosure)
Last change
28 Oct 2026, 21:10 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

zip Rust library can be tricked into writing files to attacker-chosen paths · Zero Radar