Skip to content
OpenAdvisories

Package · crates.io

zip

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 10.0
    CVE-2026-115905 Public exploit

    zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE

    zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling th…

    zip-rs zip2 rust superset-6.1 Debian Ubuntu Azure Linux Wolfi crates.io
  • Critical 9.1
    GHSA-4684-h2q9-2vcp

    ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target

    `ZipStreamReader::extract()` applies Unix permissions through extracted symlinks without validating the symlink target stays within the destination For further details see: https://github.com/zip-rs/zip2/security/advisories/GHSA-4684-h2q9-2vcp

    zip crates.io