RUSTSEC-2026-0369 GHSA-4684-h2q9-2vcp
ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target
- Severity
- 9.1 / 10
- Critical · CVSS 3.1
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
9.0.0- Upgrade zip to this version or later
Description
ZipStreamReader::extract() applies Unix permissions through extracted symlinks without validating the symlink target stays within the destination
For further details see: https://github.com/zip-rs/zip2/security/advisories/GHSA-4684-h2q9-2vcp
Affected versions
crates.io
| Package | Vulnerable | Fixed in |
|---|---|---|
| zip | >= 0.0.0-0, < 9.0.0 |
9.0.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
zip crates.io → 9.0.0
- cargo
cargo update -p zip --precise 9.0.0
Severity breakdown
CVSS 3.1 9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- High
References
Advisories
Packages
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-hjqx-j4rw-g7xv zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. | High | Also affects zip |
| GHSA-q7v9-x93c-xqv3 zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction | High | Also affects zip |
| GHSA-m665-v7pm-7grj zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE | Critical | Also affects zip |
| GHSA-9hj8-73fh-9963 zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size | High | Also affects zip |
| GHSA-8hxf-qr8p-62x4 zip: AES Entry HMAC Authentication Bypass on Premature EOF | Medium | Also affects zip |
| RUSTSEC-2026-0368 zip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination directory | Not rated yet | Also affects zip |
| RUSTSEC-2026-0367 Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation | High | Also affects zip |
| GHSA-94vh-gphv-8pm8 zip Incorrectly Canonicalizes Paths during Archive Extraction Leading to Arbitrary File Write | High | Also affects zip |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor