CVE-2026-115908

What it actually does

Path traversal in ZipArchive::extract and ZipArchive::extract_unwrapped_root_dir caused by lexical prefix comparison on symlink targets instead of full resolution of intermediate links, allowing writes outside the intended extraction directory; Windows drive/UNC prefix stripping enables single-link escapes when SeCreateSymbolicLinkPrivilege is present.

Why it matters to the business

Attackers can create or overwrite files with the privileges of the extracting process, enabling arbitrary code execution, configuration tampering, or data destruction; the flaw is recent and unexploited in the wild but affects any application using the vulnerable library for untrusted archives.

How an attack unfolds

An attacker crafts a ZIP archive containing a chain of symbolic links whose lexical paths remain under the guessed extraction root while intermediate links resolve outside it; when a victim application extracts the archive the library follows the links and writes attacker-controlled content to arbitrary locations on disk.

How to fix it

Upgrade the zip crate to version 9.0.0 or later; rebuild and redeploy all dependent applications; until upgrade is possible, avoid extracting untrusted archives or run extraction under a restricted user context that lacks symlink creation privileges.

How to confirm the fix worked

Confirm the zip dependency version is 9.0.0 or newer in Cargo.lock; run integration tests that attempt symlink escapes into a monitored directory and verify writes are rejected; scan source for direct calls to the affected extract methods.

Typical attack path

1. attacker prepares malicious ZIP with crafted symlink chain
2. attacker delivers archive to target (download, attachment, repository)
3. victim application calls ZipArchive::extract or extract_unwrapped_root_dir on the archive
4. library performs lexical validation and follows unresolved symlinks
5. attacker-controlled files are written outside the intended directory

How to detect it

Review application logs for extraction operations on untrusted archives; correlate file-creation events outside expected directories with archive processing; inspect process creation or file writes performed under the context of applications that depend on the zip crate.

What your security team should do

• Immediately inventory all Rust projects using the zip crate and schedule upgrade to 9.0.0
• Add automated dependency scanning to block future vulnerable versions
• Restrict symlink creation privileges for extraction processes on Windows
• Monitor public exploit development given the five-day publication window