CVE-2026-115905

What it actually does

ZipArchive and ZipStreamReader in the zip Rust crate through 9.0.4 read filenames from mismatched ZIP header structures (central directory vs local file header) without reconciliation, allowing a crafted archive to present benign metadata to directory-based inspection while directing a streaming extractor to write attacker-controlled paths and content.

Why it matters to the business

Applications that extract ZIP archives via streaming can have arbitrary files overwritten, resulting in service disruption, data corruption, or potential execution of attacker-supplied code within four days of disclosure.

How an attack unfolds

An attacker constructs a ZIP archive whose central directory contains innocuous filenames while the local file headers specify different, malicious paths and payloads. When a downstream service uses ZipStreamReader for extraction, the library writes the attacker-selected content to the chosen locations without validation, bypassing any central-directory inspection performed by ZipArchive.

How to fix it

Upgrade the zip crate to version 9.0.5 or later; rebuild and redeploy all dependent Rust binaries; replace any direct use of ZipStreamReader with reconciled extraction logic until the update is complete.

How to confirm the fix worked

Inspect Cargo.lock or equivalent dependency manifests for zip versions prior to 9.0.5; run the library's test suite against archives that contain mismatched header filenames to confirm path reconciliation now occurs.

Typical attack path

1. Create a ZIP archive with deliberately mismatched central-directory and local-file-header metadata
2. Deliver the archive to a target application that processes it with the vulnerable zip crate
3. Trigger extraction through ZipStreamReader on the crafted archive
4. Overwrite files at attacker-chosen paths on the target system

How to detect it

Review application logs for ZIP extraction events that result in files written outside expected directories; search dependency manifests and runtime process lists for the vulnerable zip crate version.

What your security team should do

• Immediately upgrade all instances of the zip crate to 9.0.5
• Audit codebases for usage of ZipStreamReader and replace with reconciled extraction
• Add automated dependency scanning to block future vulnerable versions
• Monitor extraction operations for unexpected file writes