CVE-2026-115905: zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE

Q: Which applications are exposed to this issue?

Applications using the Rust zip crate through version 9.0.4 are exposed when they inspect ZIP entries through the central directory but extract the same archive with ZipStreamReader. The risk is greatest where archive contents are validated or allowlisted before extraction and extracted paths can overwrite files consumed by another service.

Q: What does an attacker need to exploit the flaw?

An attacker needs to provide a crafted ZIP archive with inconsistent filenames or metadata between its Central Directory File Headers and Local File Headers. The archive must be accepted by a component that trusts the central directory and then processed by a streaming extractor that uses the local headers.

Q: How can this be remediated?

Upgrade the zip crate to version 9.0.5, which fixes the mismatch handling. If upgrading cannot happen immediately, do not rely on central-directory inspection alone when accepting untrusted archives; ensure the extraction path validates the metadata it actually uses before writing files.

Q: How can teams determine whether their implementation is affected?

Review dependencies for crates/zip versions through 9.0.4 and identify uses of ZipStreamReader for extracting ZIP archives. Investigate workflows that perform separate pre-extraction checks based on central-directory entry names or metadata, especially when archives originate from untrusted sources.

Published Oct 26, 2026

Updated

zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in src/read/stream.rs. A crafted archive can therefore appear benign to a component that inspects the central directory but cause a streaming extractor to write a different attacker-selected path and content, potentially overwriting files used by a downstream service. This issue is fixed in version 9.0.5.

Affected Software

1 affected component

crates/zip<=9.0.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade zip to a version that resolves this vulnerability.
Fixed in 9.0.5

Event History

Oct 26, 2026

CVE Published

via MITRE·04:24 PM

Data Sourced

via MITRE·04:24 PM

DescriptionWeakness

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using the Rust zip crate through version 9.0.4 are exposed when they inspect ZIP entries through the central directory but extract the same archive with ZipStreamReader. The risk is greatest where archive contents are validated or allowlisted before extraction and extracted paths can overwrite files consumed by another service.

What does an attacker need to exploit the flaw?

An attacker needs to provide a crafted ZIP archive with inconsistent filenames or metadata between its Central Directory File Headers and Local File Headers. The archive must be accepted by a component that trusts the central directory and then processed by a streaming extractor that uses the local headers.

How can this be remediated?

Upgrade the zip crate to version 9.0.5, which fixes the mismatch handling. If upgrading cannot happen immediately, do not rely on central-directory inspection alone when accepting untrusted archives; ensure the extraction path validates the metadata it actually uses before writing files.

How can teams determine whether their implementation is affected?

Review dependencies for crates/zip versions through 9.0.4 and identify uses of ZipStreamReader for extracting ZIP archives. Investigate workflows that perform separate pre-extraction checks based on central-directory entry names or metadata, especially when archives originate from untrusted sources.

CVE-2026-115905: zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit the flaw?

How can this be remediated?

How can teams determine whether their implementation is affected?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit the flaw?

How can this be remediated?

How can teams determine whether their implementation is affected?