Path Traversal Vulnerability in Zip Library for Rust by Zip
CVE-2026-115908

7.4HIGH

Key Information:

Vendor

Zip-rs

Status
Zip2
Vendor
CVE Published:
26 October 2026

What is CVE-2026-115908?

The Zip library for Rust contained a vulnerability affecting versions from 7.2.0 to 9.0.0, in which the extraction functions did not correctly validate symbolic link targets. An attacker could exploit this flaw by carefully crafting a symlink that appears to target a location within the extraction directory but actually points to a location outside of it. This could lead to unauthorized file creation or overwriting using the privileges of the extraction process. On Windows systems, special privileges such as SeCreateSymbolicLinkPrivilege can exacerbate this issue by allowing additional escape scenarios. The vulnerability has been addressed in version 9.0.0.

Affected Version(s)

zip2 >= 7.2.0, < 9.0.0

References

https://github.com/zip-rs/zip2/security/advisories/GHSA-h...
x_refsource_CONFIRM
https://github.com/zip-rs/zip2/commit/09c030eab56e8db8fb3...
x_refsource_MISC
https://github.com/zip-rs/zip2/releases/tag/v9.0.0
x_refsource_MISC

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.