CVE-2026-115905: falha crítica em zip-rs zip2
zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
48Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 10epss 0.3%
da publicação à arma1 dia
Publicada no NVD26 de out.
1ª PoC+1d
zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in src/read/stream.rs. A crafted archive can therefore appear benign to a component that inspects the central directory but cause a streaming extractor to write a different attacker-selected path and content, potentially overwriting files used by a downstream service. This issue is fixed in version 9.0.5.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L
Produtos afetados
zip-rs · zip2PoCs públicas encontradas — 2
githubgithub.com/cosmonic-labs/demo-zip-rce-sandbox★ 1githubgithub.com/foxcornlab/zip-cloaking-scanner★ 0⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — zip-rs zip2
No mesmo produto, das mais perigosas para as menos.
CVE-2025-29787HIGHzip Vulnerable to Incorrect Path Canonicalization During Archive Extraction, Leading to Arbitrary File WriteEPSS 0.6%CVE-2026-115909HIGHzip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During ExtractionEPSS 0.5%CVE-2026-115908HIGHzip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (The defense against CVE-2025-29787 was broken in v7.2.0)EPSS 0.4%CVE-2026-115907HIGHzip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed sizeEPSS 0.4%CVE-2026-115906MEDIUMzip: AES Entry HMAC Authentication Bypass on Premature EOFEPSS 0.2%