{"id":"EUVD-2026-109985","enisaUuid":"13b9b661-e7ae-3993-8033-b3fcac6dc4a7","description":"zip is a zip library for Rust that supports reading and writing simple ZIP files. From 7.2.0 until 9.0.0, ZipArchive::extract and ZipArchive::extract_unwrapped_root_dir use safe_prepare_path in src/read/zipfile.rs and simplified_components in src/path.rs to validate symbolic link targets with a lexical prefix comparison rather than resolving each intermediate link. An attacker who knows or can guess the absolute extraction destination can create a chain whose apparent target remains under the destination while an intermediate symlink resolves outside it, allowing attacker-controlled files to be created or overwritten with the extracting process\u0027s privileges. On Windows, discarded drive and UNC prefixes can permit a single-link escape when the process has SeCreateSymbolicLinkPrivilege, such as through administrator rights or Developer Mode. This regression is distinct from CVE-2025-29787. This issue is fixed in version 9.0.0.","datePublished":"Oct 26, 2026, 4:34:29 PM","dateUpdated":"Oct 26, 2026, 7:36:11 PM","baseScore":7.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","references":"https://github.com/zip-rs/zip2/security/advisories/GHSA-hjqx-j4rw-g7xv\nhttps://github.com/zip-rs/zip2/commit/09c030eab56e8db8fb3c1c33f554407b30bad8fa\nhttps://github.com/zip-rs/zip2/releases/tag/v9.0.0\n","aliases":"CVE-2026-115908\nGHSA-hjqx-j4rw-g7xv\n","assigner":"GitHub_M","epss":0.43,"enisaIdProduct":[{"id":"00654482-9eeb-3f48-a2c2-695123f14e66","product":{"name":"zip2","vendor":{"name":"zip-rs"}},"product_version":"7.2.0, \u003c 9.0.0"}],"enisaIdVendor":[{"id":"59944a65-9b27-399f-aacf-17eadcac26ed","vendor":{"name":"zip-rs"}}],"enisaIdVulnerability":[{"id":"2a6ff3ce-6a73-3f5b-b05f-2c289e4c16f3","vulnerability":{"id":"CVE-2026-115908","description":"zip is a zip library for Rust that supports reading and writing simple ZIP files. From 7.2.0 until 9.0.0, ZipArchive::extract and ZipArchive::extract_unwrapped_root_dir use safe_prepare_path in src/read/zipfile.rs and simplified_components in src/path.rs to validate symbolic link targets with a lexical prefix comparison rather than resolving each intermediate link. An attacker who knows or can guess the absolute extraction destination can create a chain whose apparent target remains under the destination while an intermediate symlink resolves outside it, allowing attacker-controlled files to be created or overwritten with the extracting process\u0027s privileges. On Windows, discarded drive and UNC prefixes can permit a single-link escape when the process has SeCreateSymbolicLinkPrivilege, such as through administrator rights or Developer Mode. This regression is distinct from CVE-2025-29787. This issue is fixed in version 9.0.0.","datePublished":"Oct 26, 2026, 4:34:29 PM","dateUpdated":"Oct 26, 2026, 7:36:11 PM","status":"PUBLISHED","baseScore":7.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","references":"https://github.com/zip-rs/zip2/security/advisories/GHSA-hjqx-j4rw-g7xv\nhttps://github.com/zip-rs/zip2/commit/09c030eab56e8db8fb3c1c33f554407b30bad8fa\nhttps://github.com/zip-rs/zip2/releases/tag/v9.0.0\n","enisa_id":"EUVD-2026-109985\n","assigner":"GitHub_M","epss":0.43,"dataProcessed":"Oct 31, 2026, 7:14:52 AM","vulnerabilityProduct":[{"id":"fbc76c11-d70c-327f-b0e9-75df964544e6","product":{"name":"zip2","vendor":{"name":"zip-rs"}},"product_version":"7.2.0, \u003c 9.0.0"}],"vulnerabilityVendor":[{"id":"011689d2-4e82-349c-9ddf-54f730d46dc5","vendor":{"name":"zip-rs"}}]}},{"id":"ceaa821f-2140-3840-ba77-6f514c04f2d0","vulnerability":{"id":"GHSA-hjqx-j4rw-g7xv","description":"zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. ","datePublished":"Oct 29, 2026, 4:40:12 PM","dateUpdated":"Oct 29, 2026, 4:40:13 PM","baseScore":0.0,"references":"https://github.com/zip-rs/zip2/security/advisories/GHSA-hjqx-j4rw-g7xv\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-115908\nhttps://github.com/zip-rs/zip2/commit/09c030eab56e8db8fb3c1c33f554407b30bad8fa\nhttps://github.com/zip-rs/zip2\nhttps://github.com/zip-rs/zip2/releases/tag/v9.0.0\n","enisa_id":"EUVD-2026-109985\n","aliases":"CVE-2026-115908\nGHSA-hjqx-j4rw-g7xv\n","epss":0.0,"dataProcessed":"Oct 31, 2026, 9:01:46 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"16261e12-464a-393e-b4e6-c52ada797e8e","advisory":{"id":"openSUSE-SU-2026:12333-1","description":"keylime-ima-policy-0.2.10+12-1.1 on GA media","summary":"keylime-ima-policy-0.2.10+12-1.1 on GA media","datePublished":"Oct 28, 2026, 12:00:00 AM","dateUpdated":"Oct 29, 2026, 6:23:48 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_12333-1.json\nhttps://www.suse.com/security/cve/CVE-2026-115905/\nhttps://www.suse.com/security/cve/CVE-2026-115908/\n","aliases":"CVE-2026-115905\nCVE-2026-115908\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"2223a7cf-1ed8-30f2-b8b9-b6dd4ec3f19a","product":{"name":"keylime-ima-policy-0:0.2.10+12-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"2427fc4d-cb49-364e-9cbc-fa31efa886d5","product":{"name":"rust-keylime-0:0.2.10+12-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"25552e2f-a0a7-3ca3-af03-9a29c16c1821","product":{"name":"keylime-ima-policy-0:0.2.10+12-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"68b047ae-2162-3390-9162-b561df5b2476","product":{"name":"keylime-ima-policy-0:0.2.10+12-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"6d839472-f5f3-3faf-9dd4-7261f7e6fad8","product":{"name":"keylime-ima-policy-0:0.2.10+12-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"715a9547-266c-3a02-bc41-8dbceb1c4291","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"75791a2a-a71f-3339-b79f-a0a82031a869","product":{"name":"rust-keylime-0:0.2.10+12-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"b9e603a6-a351-3f7a-8703-1833cfcfa009","product":{"name":"rust-keylime-0:0.2.10+12-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"f05134ee-6822-3a39-a095-99d4f2b3738c","product":{"name":"rust-keylime-0:0.2.10+12-1.1.ppc64le","vendor":{"name":"SUSE"}}}]}},{"id":"8891894b-08ff-3cc4-8a80-920866a510de","advisory":{"id":"openSUSE-SU-2026:12307-1","description":"python313-uv-0.13.6-1.1 on GA media","summary":"python313-uv-0.13.6-1.1 on GA media","datePublished":"Oct 27, 2026, 12:00:00 AM","dateUpdated":"Oct 28, 2026, 11:19:38 AM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_12307-1.json\nhttps://www.suse.com/security/cve/CVE-2026-115905/\nhttps://www.suse.com/security/cve/CVE-2026-115907/\nhttps://www.suse.com/security/cve/CVE-2026-115908/\n","aliases":"CVE-2026-115905\nCVE-2026-115907\nCVE-2026-115908\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"05d7f99a-2571-39fa-9ffe-b675bf82b4ef","product":{"name":"uv-fish-completion-0:0.13.6-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"33da3320-70be-335e-b633-6a85a040ad44","product":{"name":"uv-fish-completion-0:0.13.6-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"369b9ee6-af3b-3443-8c46-df4f18378d6f","product":{"name":"uv-zsh-completion-0:0.13.6-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"41a19ea8-fc78-3b00-98ec-8a259f1ca9c2","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"4dc9174d-ca15-33fe-9afa-e12953e94b07","product":{"name":"python314-uv-0:0.13.6-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"5960cf4a-6d35-381e-b54b-349c92382fa5","product":{"name":"uv-fish-completion-0:0.13.6-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"5bc4ed21-fc5d-39c5-97dc-0a1356ef319e","product":{"name":"python313-uv-0:0.13.6-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"63ba713e-e4ad-3bf7-a2e8-213b51af6c17","product":{"name":"uv-zsh-completion-0:0.13.6-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"66715771-1725-3622-89db-56b9993a088c","product":{"name":"uv-zsh-completion-0:0.13.6-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"8f6950ff-cb3e-3695-9841-effe85a722de","product":{"name":"python314-uv-0:0.13.6-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"9632b045-f727-3f2d-9f90-abf294cabfba","product":{"name":"python313-uv-0:0.13.6-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"a479a0a5-ef0e-357b-8f7d-8f835957a094","product":{"name":"python314-uv-0:0.13.6-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"a57c10e3-ea9f-34db-95df-62107e50a24b","product":{"name":"uv-bash-completion-0:0.13.6-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"acf75047-84e2-35c2-951c-7bfa138c8e3a","product":{"name":"python313-uv-0:0.13.6-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"ad1edc03-cecd-36ce-a95f-27f9aa54e201","product":{"name":"python313-uv-0:0.13.6-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"b8038ecd-e153-3298-bb67-a42f716df154","product":{"name":"uv-zsh-completion-0:0.13.6-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"bd811bf9-3283-30a2-8541-b290d3be3dc2","product":{"name":"python314-uv-0:0.13.6-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"bdb5ad41-a62d-399b-95d3-0cf40e27e5b1","product":{"name":"uv-fish-completion-0:0.13.6-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"bfd01e40-b772-32c8-8ad1-4e0d296f9013","product":{"name":"uv-bash-completion-0:0.13.6-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"dfb04450-666d-36d4-a7fc-4f4370708ee5","product":{"name":"uv-bash-completion-0:0.13.6-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"e202162e-56c9-3daa-aa85-c5bc2e1ce137","product":{"name":"uv-bash-completion-0:0.13.6-1.1.ppc64le","vendor":{"name":"SUSE"}}}]}}]}