HighVulnerabilityCVE-2026-115908updated 29 Oct 2026, 16:40 UTC

Rust zip library can let a crafted archive write files outside the extraction folder

A specially crafted zip file can trick the program into saving files somewhere other than the folder it was meant to unpack into. On Windows, a single shortcut inside the archive is enough when the program runs with admin rights or Develope

Fixed in 9.0.0Official, 2 sources

Severity	HighCVSS 7.4 of 10
Being exploited?	UnclearNo reports either way yet
Fix available?	Yes9.0.0 · since 29 Oct 2026
How sure is this?	Official, 2 sourcesBacked by an official source

How the attack works simplified

1Attacker crafts archiveIncludes symlink chain or drive-prefixed link
2Archive is extractedProgram calls ZipArchive::extract
3Lexical check passesPrefix comparison does not resolve links
4File written outside targetHappens with the process's privileges
ResultAttacker controls files outside extraction folder

What happened

The zip crate for Rust (versions 7.2.0 up to 9.0.0) validates symbolic link targets using only a lexical prefix comparison instead of resolving intermediate links, allowing a chain of symlinks to escape the extraction destination; on Windows, discarded drive and UNC prefixes allow a single-link escape.

Why it is dangerous: An attacker can create or overwrite arbitrary files with the privileges of the extracting process, which can lead to tampering with system or application files. Anyone who unpacks untrusted zip archives using the affected library is at risk, and the attack is realistic when the destination path is known or guessable, such as CI workspaces or fixed paths like /opt/app.

Are you affected?

You are affected if your project uses the Rust zip crate version 7.2.0 or later but before 9.0.0 and calls ZipArchive::extract or extract_unwrapped_root_dir on archives you do not fully trust.

Package / product	Affected versions	Fixed in
zip · rust	>= 7.2.0, < 9.0.0	9.0.0

What to do

Update the zip crate to version 9.0.0 or later
Avoid running extraction with administrator rights or Developer Mode enabled on Windows
Only extract archives from trusted sources until the update is applied

Timeline

26 Oct 2026, 17:17 UTC
Publicly disclosed
26 Oct 2026, 17:17 UTC
Reported by NVD · NVD
26 Oct 2026, 17:21 UTC
Picked up by Zero Radar
29 Oct 2026, 16:40 UTC
GitHub Advisory reported on it · GitHub Advisory
29 Oct 2026, 16:40 UTC
Fixed version published: zip 9.0.0 · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

CVE-2026-115908NVD · 26 Oct 2026, 17:17 UTC
zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. GitHub Advisory · 29 Oct 2026, 16:40 UTC

Technical details

ID: CVE-2026-115908 · GHSA-hjqx-j4rw-g7xv
CVSS: 7.4 / 10
EPSS: 0.4% chance of exploitation within 30 days
Disclosed: 26 Oct 2026, 17:17 UTC
On Zero Radar: 26 Oct 2026, 17:21 UTC (5 min after disclosure)
Last change: 29 Oct 2026, 16:40 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works