RUSTSEC-2026-0367 GHSA-vv5m-jxxh-4627
Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation
- Severity
- 7.3 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
9.0.0- Upgrade zip to this version or later
Description
The zip crate preserves privileged Unix permission bits (SUID, SGID, and sticky bits) from ZIP external_attributes during extraction, instead of masking them to safe permission bits. If a privileged process (for example, root in an installer, CI/CD pipeline, or container build) extracts an attacker-controlled ZIP archive using ZipArchive::extract() or the stream extraction API, files can be created as setuid-root or setgid. This behavior allows the creation of SUID/SGID files during extraction, which can lead to local privilege escalation depending on the execution environment.
For further details see: https://github.com/zip-rs/zip2/security/advisories/GHSA-vv5m-jxxh-4627
Affected versions
crates.io
| Package | Vulnerable | Fixed in |
|---|---|---|
| zip | >= 0.0.0-0, < 9.0.0 |
9.0.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
zip crates.io → 9.0.0
- cargo
cargo update -p zip --precise 9.0.0
Severity breakdown
CVSS 3.1 7.3
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
References
Advisories
Packages
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-hjqx-j4rw-g7xv zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. | High | Also affects zip |
| GHSA-q7v9-x93c-xqv3 zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction | High | Also affects zip |
| GHSA-m665-v7pm-7grj zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE | Critical | Also affects zip |
| GHSA-9hj8-73fh-9963 zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size | High | Also affects zip |
| GHSA-8hxf-qr8p-62x4 zip: AES Entry HMAC Authentication Bypass on Premature EOF | Medium | Also affects zip |
| RUSTSEC-2026-0369 ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target | Critical | Also affects zip |
| RUSTSEC-2026-0368 zip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination directory | Not rated yet | Also affects zip |
| GHSA-94vh-gphv-8pm8 zip Incorrectly Canonicalizes Paths during Archive Extraction Leading to Arbitrary File Write | High | Also affects zip |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor