CVE-2026-115908 in zip2
Summary
by MITRE • 10/26/2026
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 7.2.0 until 9.0.0, ZipArchive::extract and ZipArchive::extract_unwrapped_root_dir use safe_prepare_path in src/read/zipfile.rs and simplified_components in src/path.rs to validate symbolic link targets with a lexical prefix comparison rather than resolving each intermediate link. An attacker who knows or can guess the absolute extraction destination can create a chain whose apparent target remains under the destination while an intermediate symlink resolves outside it, allowing attacker-controlled files to be created or overwritten with the extracting process's privileges. On Windows, discarded drive and UNC prefixes can permit a single-link escape when the process has SeCreateSymbolicLinkPrivilege, such as through administrator rights or Developer Mode. This regression is distinct from CVE-2025-29787. This issue is fixed in version 9.0.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/26/2026
The vulnerability identified in the Rust zip library affects versions ranging from 7.2.0 through 9.0.0, specifically within the ZipArchive::extract and ZipArchive::extract_unwrapped_root_dir functions. This security flaw stems from an insufficient validation mechanism for symbolic link targets during archive extraction. The core technical deficiency lies in the use of safe_prepare_path located in src/read/zipfile.rs combined with simplified_components found in src/path.rs. These components implement a lexical prefix comparison to determine if a symlink target remains within the intended extraction directory. This approach is fundamentally flawed because it does not resolve each intermediate symbolic link in the path chain before performing the validation check. Consequently, the library fails to account for how operating system kernel-level resolution of symlinks can alter the final absolute path, leading to a discrepancy between the perceived safe location and the actual file creation destination.
This architectural weakness allows an attacker who possesses knowledge or predictive capability regarding the absolute extraction destination to craft malicious ZIP archives containing carefully constructed chains of symbolic links. By designing these chains such that the apparent target appears to reside under the designated safe directory, while intermediate symlinks resolve outside this boundary, the extractor can be tricked into writing files to arbitrary locations on the file system. The severity of this issue is significantly amplified by the privileges held by the process executing the extraction. If the extracting application runs with elevated permissions, such as administrator rights or specific capabilities like SeCreateSymbolicLinkPrivilege on Windows, an attacker can exploit this flaw to create or overwrite critical system files and configuration data. On Microsoft Windows systems, additional risks arise from the handling of discarded drive letters and Universal Naming Convention prefixes, which can facilitate a single-link escape even without complex chain manipulation when the necessary privileges are present.
The operational impact of this vulnerability is severe, as it enables arbitrary file write operations that can lead to full system compromise. Attackers may use this capability to inject malicious scripts, replace legitimate binaries with trojanized versions, or modify configuration files to establish persistence mechanisms. This behavior aligns closely with CWE-22, which describes Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal. Furthermore, the exploitation technique involving symbolic links maps directly to MITRE ATT&CK techniques related to file and directory manipulation, specifically those that leverage symlinks for privilege escalation or lateral movement within an environment. The distinction between this issue and CVE-2025-29787 highlights a regression in security posture where previous mitigations were either removed or implemented incorrectly during development cycles, underscoring the importance of rigorous path resolution logic in archive processing libraries.
To mitigate this vulnerability, organizations must immediately upgrade to version 9.0.0 of the Rust zip library, which contains the necessary fixes for these validation flaws. For environments where upgrading is not immediately feasible, defensive coding practices should be employed by implementing manual symlink resolution before extraction begins. This involves recursively resolving all symbolic links in the archive entries against a canonical base directory and rejecting any entry that resolves outside this boundary after full kernel-level path normalization. Additionally, applications processing untrusted archives should operate with the principle of least privilege, avoiding elevated permissions whenever possible to reduce the impact of potential file system modifications. Regular security audits of dependency chains are essential to detect similar regressions in other libraries that handle compressed or archived data formats.