CVE-2026-115905: fallo crítico en zip-rs zip2
zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
48Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 10epss 0.3%
de la publicación al arma1 día
Publicada en NVD26 oct
1ª PoC+1d
zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in src/read/stream.rs. A crafted archive can therefore appear benign to a component that inspects the central directory but cause a streaming extractor to write a different attacker-selected path and content, potentially overwriting files used by a downstream service. This issue is fixed in version 9.0.5.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L
Productos afectados
zip-rs · zip2PoCs públicas encontradas — 2
githubgithub.com/cosmonic-labs/demo-zip-rce-sandbox★ 1githubgithub.com/foxcornlab/zip-cloaking-scanner★ 0⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — zip-rs zip2
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-29787HIGHzip Vulnerable to Incorrect Path Canonicalization During Archive Extraction, Leading to Arbitrary File WriteEPSS 0.6%CVE-2026-115909HIGHzip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During ExtractionEPSS 0.5%CVE-2026-115908HIGHzip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (The defense against CVE-2025-29787 was broken in v7.2.0)EPSS 0.4%CVE-2026-115907HIGHzip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed sizeEPSS 0.4%CVE-2026-115906MEDIUMzip: AES Entry HMAC Authentication Bypass on Premature EOFEPSS 0.2%