{"id":"EUVD-2026-109985","enisaUuid":"13b9b661-e7ae-3993-8033-b3fcac6dc4a7","description":"zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. ","datePublished":"Oct 29, 2026, 4:40:12 PM","dateUpdated":"Oct 29, 2026, 4:40:13 PM","baseScore":7.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","references":"https://github.com/zip-rs/zip2/security/advisories/GHSA-hjqx-j4rw-g7xv\nhttps://github.com/zip-rs/zip2/commit/09c030eab56e8db8fb3c1c33f554407b30bad8fa\nhttps://github.com/zip-rs/zip2/releases/tag/v9.0.0\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-115908\n","aliases":"CVE-2026-115908\nGHSA-hjqx-j4rw-g7xv\n","assigner":"GitHub_M","epss":0.43,"enisaIdProduct":[{"id":"00654482-9eeb-3f48-a2c2-695123f14e66","product":{"name":"zip2","vendor":{"name":"zip-rs"}},"product_version":"7.2.0, \u003c 9.0.0"}],"enisaIdVendor":[{"id":"59944a65-9b27-399f-aacf-17eadcac26ed","vendor":{"name":"zip-rs"}}],"enisaIdVulnerability":[{"id":"2a6ff3ce-6a73-3f5b-b05f-2c289e4c16f3","vulnerability":{"id":"CVE-2026-115908","description":"zip is a zip library for Rust that supports reading and writing simple ZIP files. From 7.2.0 until 9.0.0, ZipArchive::extract and ZipArchive::extract_unwrapped_root_dir use safe_prepare_path in src/read/zipfile.rs and simplified_components in src/path.rs to validate symbolic link targets with a lexical prefix comparison rather than resolving each intermediate link. An attacker who knows or can guess the absolute extraction destination can create a chain whose apparent target remains under the destination while an intermediate symlink resolves outside it, allowing attacker-controlled files to be created or overwritten with the extracting process\u0027s privileges. On Windows, discarded drive and UNC prefixes can permit a single-link escape when the process has SeCreateSymbolicLinkPrivilege, such as through administrator rights or Developer Mode. This regression is distinct from CVE-2025-29787. This issue is fixed in version 9.0.0.","datePublished":"Oct 26, 2026, 4:34:29 PM","dateUpdated":"Oct 26, 2026, 7:36:11 PM","status":"PUBLISHED","baseScore":7.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","references":"https://github.com/zip-rs/zip2/security/advisories/GHSA-hjqx-j4rw-g7xv\nhttps://github.com/zip-rs/zip2/commit/09c030eab56e8db8fb3c1c33f554407b30bad8fa\nhttps://github.com/zip-rs/zip2/releases/tag/v9.0.0\n","enisa_id":"EUVD-2026-109985\n","assigner":"GitHub_M","epss":0.43,"dataProcessed":"Oct 29, 2026, 7:14:41 AM","vulnerabilityProduct":[{"id":"fbc76c11-d70c-327f-b0e9-75df964544e6","product":{"name":"zip2","vendor":{"name":"zip-rs"}},"product_version":"7.2.0, \u003c 9.0.0"}],"vulnerabilityVendor":[{"id":"011689d2-4e82-349c-9ddf-54f730d46dc5","vendor":{"name":"zip-rs"}}]}},{"id":"ceaa821f-2140-3840-ba77-6f514c04f2d0","vulnerability":{"id":"GHSA-hjqx-j4rw-g7xv","description":"zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. ","datePublished":"Oct 29, 2026, 4:40:12 PM","dateUpdated":"Oct 29, 2026, 4:40:13 PM","baseScore":0.0,"references":"https://github.com/zip-rs/zip2/security/advisories/GHSA-hjqx-j4rw-g7xv\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-115908\nhttps://github.com/zip-rs/zip2/commit/09c030eab56e8db8fb3c1c33f554407b30bad8fa\nhttps://github.com/zip-rs/zip2\nhttps://github.com/zip-rs/zip2/releases/tag/v9.0.0\n","enisa_id":"EUVD-2026-109985\n","aliases":"CVE-2026-115908\nGHSA-hjqx-j4rw-g7xv\n","epss":0.0,"dataProcessed":"Oct 29, 2026, 8:01:07 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}