{"id":"EUVD-2026-109981","revision":"43b69af4c9ed4908af038a95569728ec","records":[{"revision":"43b69af4c9ed4908af038a95569728ec","observedAt":"2026-10-28T22:55:58.012+00:00","statement":{"source":"euvd","id":"EUVD-2026-109981","aliases":["CVE-2026-115905","GHSA-m665-v7pm-7grj"],"title":"zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE","description":"zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L","score":10,"severity":null}],"references":["https://github.com/zip-rs/zip2/security/advisories/GHSA-m665-v7pm-7grj","https://github.com/zip-rs/zip2/commit/8068ab480ccf8daa7411424e365fcdbe6d09443e","https://github.com/zip-rs/zip2/releases/tag/v9.0.5","https://nvd.nist.gov/vuln/detail/CVE-2026-115905"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-109981","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 28, 2026, 9:09:50 PM","dateUpdated":"Oct 28, 2026, 9:09:51 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-109981","identifiers":["EUVD-2026-109981","CVE-2026-115905","GHSA-m665-v7pm-7grj"]},"retained":false,"historicalAffected":[]}],"coverage":[]}