RustSec logo

History ⋅ Edit ⋅ JSON (OSV)

RUSTSEC-2026-0369

ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target
Reported
Issued
Package
zip (crates.io)
Type
Vulnerability
Categories
Keywords
#privilege-escalation #symlink #permissions
Aliases
CVSS Score
9.1 CRITICAL
CVSS Details
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality Impact
None
Integrity Impact
High
Availability Impact
High
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Patched
  • >=9.0.0

Description

ZipStreamReader::extract() applies Unix permissions through extracted symlinks without validating the symlink target stays within the destination

For further details see: https://github.com/zip-rs/zip2/security/advisories/GHSA-4684-h2q9-2vcp

Advisory available under CC0-1.0 license.