ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-115908

zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically.

Published Oct 29, 2026 · catalog updated Oct 29, 2026 · zip: Arbitrary file write

Last checked Nov 5, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-115908. EPSS is 0.43%. Act only if a listed version of zip: Arbitrary file write is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (zip: Arbitrary file write).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High7.4
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.43%
Remediation
Version ranges on file
Affected products
cargo zip · rust zip

### Summary - **Verified version:** zip - **Affected versions:** and later - **Precondition:** The attacker knows (or can guess) the absolute path of the extraction destination The validation applied to symlinks is purely lexical. As a result, an attacker can write arbitrary files outside the extraction directory through a symlink. Exploitation requires the attacker to know (or guess) the absolute path of the destination, but this is realistic in practice: CI workspaces, , a fixed Downloads path, and so on. > **Impact extends further on Windows (verified on real hardware for both the separate-drive and UNC-share cases)**: > Because discards the component, paths like or a UNC path pass the check. > As a result, gets replaced onto a different drive/remote share, so **a single symlink is enough — no intermediate symlink chain is required**. > That said, creating a symlink on Windows requires (administrator rights or Developer Mode enabled). > **Real-hardware verification (Windows 10 VM (19045.2604), )**: > With the extraction target set to a temporary directory under , both of the following paths returned from and successfully wrote outside the extraction target. > In both cases returned no error ( ), and it was confirmed that the contents of matched the attacker-specified value. ### Relationship to CVE-2025-29787 This is **not a duplicate** of the existing [CVE-2025-29787](https://github.com/zip-rs/zip2/security/advisories/GHSA-94vh-gphv-8pm8) (2025-03); rather, **the protection introduced for that CVE was subsequently lost**. #### Timeline (git history, UTC) | commit | Date | Description | | ---------- | ---------- | ---------------------------------------------------------------------------------------------------------------- | | | 2025-02-28 | Initial fix for CVE-2025-29787. Canonicalizes output paths and symlink targets and verifies they descend from the destination | | | 2025-03-15 | **Before the v2.3.0 release**, the above is replaced with a lexical check based

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • cargo zipversion unspecified
  • rust zip>= 7.2.0, < 9.0.0

How to fix CVE-2026-115908

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-115908. EPSS is 0.43%. Act only if a listed version of zip: Arbitrary file write is installed.

Which versions are affected?

Compare what you have installed with >= 7.2.0, < 9.0.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-22: Path Traversal; CWE-59: Link Following; CWE-61. EPSS 0.43%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 29, 2026 · GitHub Advisory Database

    Detected

    ### Summary - **Verified version:** zip - **Affected versions:** and later - **Precondition:** The attacker knows (or can guess) the absolute path of the extraction destination The validation applied to symlinks is purely lexical. As a result, an attacker can write arbitrary files outside the extraction directory through a symlink. Exploitation requires the attacker to know (or guess) the absolute

  2. Oct 29, 2026 · GitHub Advisory Database

    Updated

    ### Summary - **Verified version:** zip - **Affected versions:** and later - **Precondition:** The attacker knows (or can guess) the absolute path of the extraction destination The validation applied to symlinks is purely lexical. As a result, an attacker can write arbitrary files outside the extraction directory through a symlink. Exploitation requires the attacker to know (or guess) the absolute

Sources

  • CVE.orgVulnerability recordCVE-2026-115908

    Official CVE identifier

    cve.org
  • GitHub Advisory DatabasePackage advisoryGHSA-hjqx-j4rw-g7xv

    zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically.

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-115908

    Verified version: zip 9.0.0-pre3 Affected versions: 7.2.0 and later Precondition: The attacker knows (or can guess) the absolute path of the extraction destination The validation applied to symlinks is purely lexical. As a result, an attacker can write arbitrary files outside the extraction directory through a symlink. Exploitation requires the attacker to know (or guess) the absolute path of the

    advisories.gitlab.com

References

Freshness

Last verified in this catalog Nov 5, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • CVE.orgOct 30, 2026
  • GitLab Advisory DatabaseOct 30, 2026
  • GitHub Advisory DatabaseOct 30, 2026