Description
zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in src/read/stream.rs. A crafted archive can therefore appear benign to a component that inspects the central directory but cause a streaming extractor to write a different attacker-selected path and content, potentially overwriting files used by a downstream service. This issue is fixed in version 9.0.5.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| zip-rs | zip2 | < 9.0.5 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rust-zip | No fix yet | — |
| Debian 13 | rust-zip | No fix yet | — |
| Debian 12 | rust-zip | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | rust-zip | No fix yet | — |
| Ubuntu 26.04 LTS | rust-zip | No fix yet | — |
| Ubuntu 24.04 LTS | rust-zip | No fix yet | — |
| Ubuntu 22.04 LTS | rust-zip | No fix yet | — |
| Ubuntu 20.04 LTS | rust-zip | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | rust-keylime | 0.2.10+12-160000.1.1 | SUSE-SU-2026:24658-1 |
| SLES 16.0 | rust-keylime | 0.2.10+12-160000.1.1 | SUSE-SU-2026:24658-1 |
| SLE Micro 6.2 | rust-keylime | 0.2.10+12-160000.1.1 | SUSE-SU-2026:24641-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 5.5 | rust-keylime | 0.2.10+12-150500.3.22.1 | SUSE-SU-2026:4931-1 |
| SLE Micro 5.4 | rust-keylime | 0.2.10+12-150400.3.22.1 | SUSE-SU-2026:4930-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | gleam | 1.19.2-1.1 | openSUSE-SU-2026:12454-1 |
| openSUSE Tumbleweed | goose | 1.59.0-1.1 | openSUSE-SU-2026:12541-1 |
| openSUSE Tumbleweed | openai-codex | 0.166.0-2.1 | openSUSE-SU-2026:12488-1 |
| openSUSE Tumbleweed | python-uv | 0.13.6-1.1 | openSUSE-SU-2026:12307-1 |
| openSUSE Tumbleweed | rust-keylime | 0.2.10+12-1.1 | openSUSE-SU-2026:12333-1 |
| openSUSE Leap 16.0 | rust-keylime | 0.2.10+12-160000.1.1 | openSUSE-SU-2026:22249-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | rust | No fix yet | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | ascan +2 | No fix yet | — |
| Wolfi rolling | codex | 0.165.0-r2 | — |
| Wolfi rolling | nushell | 0.116.1-r7 | — |
| Wolfi rolling | pixi | 0.84.0-r0 | — |
| Wolfi rolling | pnpm-12 | 12.18.0-r0 | — |
| Wolfi rolling | ruff +1 | 0.17.4-r0 | — |
| Wolfi rolling | superset-6.1 | 6.1.0-r25 | — |
| Wolfi rolling | verus | 0.2026.10.18-r1 | — |
| Wolfi rolling | wasm-pack | 0.15.1-r1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
cosmonic-labs/demo-zip-rce-sandbox ★ 1 · Oct 28, 2026
Live demo: the same vulnerable Rust zip crate (RUSTSEC-2026-0367 setuid + CVE-2026-115905 zip cloaking) contained by a deny-by-default Cosmonic WebAssembly sandbox.
-
foxcornlab/zip-cloaking-scanner ★ 0 · Oct 27, 2026
Detection-only triage scanner for Rust zip cloaking CVE-2026-115905: Cargo version check plus Central vs Local header comparison. No payloads, no extraction.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | zip | < 9.0.5 | 9.0.5 | GHSA-m665-v7pm-7grj |
Advisories 10
- openSUSE-SU-2026:12541-1 goose-1.59.0-1.1 on GA media SUSE / openSUSE Security Updates · Nov 14, 2026
- SUSE-SU-2026:24658-1 Security update for rust-keylime SUSE / openSUSE Security Updates · Nov 12, 2026
- SUSE-SU-2026:24641-1 Security update for rust-keylime SUSE / openSUSE Security Updates · Nov 12, 2026
- openSUSE-SU-2026:22249-1 Security update for rust-keylime SUSE / openSUSE Security Updates · Nov 11, 2026
- openSUSE-SU-2026:12488-1 openai-codex-0.166.0-2.1 on GA media SUSE / openSUSE Security Updates · Nov 9, 2026
- openSUSE-SU-2026:12454-1 gleam-1.19.2-1.1 on GA media SUSE / openSUSE Security Updates · Nov 7, 2026
- SUSE-SU-2026:4931-1 Security update for rust-keylime SUSE / openSUSE Security Updates · Oct 31, 2026
- SUSE-SU-2026:4930-1 Security update for rust-keylime SUSE / openSUSE Security Updates · Oct 31, 2026
- openSUSE-SU-2026:12333-1 keylime-ima-policy-0.2.10+12-1.1 on GA media SUSE / openSUSE Security Updates · Oct 29, 2026
- openSUSE-SU-2026:12307-1 python313-uv-0.13.6-1.1 on GA media SUSE / openSUSE Security Updates · Oct 28, 2026