CVE-2026-115908
Received Received - Intake

Zip Slip Vulnerability in Rust Zip Library

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: GitHub, Inc.

Description
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 7.2.0 until 9.0.0, ZipArchive::extract and ZipArchive::extract_unwrapped_root_dir use safe_prepare_path in src/read/zipfile.rs and simplified_components in src/path.rs to validate symbolic link targets with a lexical prefix comparison rather than resolving each intermediate link. An attacker who knows or can guess the absolute extraction destination can create a chain whose apparent target remains under the destination while an intermediate symlink resolves outside it, allowing attacker-controlled files to be created or overwritten with the extracting process's privileges. On Windows, discarded drive and UNC prefixes can permit a single-link escape when the process has SeCreateSymbolicLinkPrivilege, such as through administrator rights or Developer Mode. This regression is distinct from CVE-2025-29787. This issue is fixed in version 9.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-115908
EUVD
EUVD-2026-109985

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zip-rs zip2 >= 7.2.0, < 9.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-61 The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Rust zip library versions 7.2.0 to 9.0.0. It involves ZipArchive::extract and ZipArchive::extract_unwrapped_root_dir functions incorrectly validating symbolic link targets using lexical prefix comparison instead of resolving intermediate links. This allows attackers to create chains of symlinks that appear to stay within an extraction directory but actually resolve outside it, leading to arbitrary file creation or overwriting with the process's privileges.

Detection Guidance

This vulnerability can be detected by checking the version of the zip library in use. If your system uses zip library versions between 7.2.0 and 9.0.0, it is potentially vulnerable. Run commands like 'cargo tree' in Rust projects or check dependency files (Cargo.toml) for the zip library version.

Impact Analysis

An attacker could exploit this to overwrite or create files outside the intended extraction directory, potentially leading to data corruption, unauthorized file access, or execution of malicious code with the privileges of the process performing the extraction. On Windows, this is more severe due to drive and UNC prefix handling allowing single-link escapes if the process has SeCreateSymbolicLinkPrivilege.

Compliance Impact

This vulnerability could lead to unauthorized file access or modification, violating data integrity and confidentiality requirements in GDPR and HIPAA. Organizations using affected versions may face compliance violations, data breaches, and potential legal consequences due to compromised data protection measures.

Mitigation Strategies

Immediately upgrade the zip library to version 9.0.0 or later. If upgrading is not possible, avoid using ZipArchive::extract and ZipArchive::extract_unwrapped_root_dir functions until the update is applied. Review symbolic link handling in extraction processes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115908. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart