zip (Rust): unpacking an uploaded ZIP can write files outside the target folder
Identifiers: CVE-2026-115908 · GHSA-hjqx-j4rw-g7xv · CVSS 3.1 7.4 (scored by GitHub)
What it is
The zip crate checks symbolic links inside an archive only by their text, so a crafted ZIP can plant a symlink and then write through it to any path the process can write. An app that extracts ZIP files that users upload can have its code or config overwritten, which can lead to taking over the server. The attacker needs to know or guess where the files are extracted.
Who is affected
Versions inside these ranges are affected. The fixed versions are the ones to move to.
| Registry | Package | Affected | Move to |
|---|---|---|---|
| crates.io | zip | >= 7.2.0, < 9.0.0 | 9.0.0 |
How to check
Run one of these in your project's folder; the first two download the CLI and check its SHA-256 first:
d="$(mktemp -d)" && a="xsec-$(uname -m | sed s/arm64/aarch64/)-unknown-linux-musl.tar.gz" && curl -fsSL -o "$d/$a" "https://github.com/xtruct-col/xsec-action/releases/latest/download/$a" && curl -fsSL -o "$d/checksums.txt" "https://github.com/xtruct-col/xsec-action/releases/latest/download/checksums.txt" && (cd "$d" && grep " $a$" checksums.txt | sha256sum -c -) && tar -xzf "$d/$a" -C "$d" xsec && "$d/xsec" depsdocker run --rm -v "$PWD:/src" -w /src alpine:3.20 sh -c 'apk add -q curl && d="$(mktemp -d)" && a="xsec-$(uname -m | sed s/arm64/aarch64/)-unknown-linux-musl.tar.gz" && curl -fsSL -o "$d/$a" "https://github.com/xtruct-col/xsec-action/releases/latest/download/$a" && curl -fsSL -o "$d/checksums.txt" "https://github.com/xtruct-col/xsec-action/releases/latest/download/checksums.txt" && (cd "$d" && grep " $a$" checksums.txt | sha256sum -c -) && tar -xzf "$d/$a" -C "$d" xsec && "$d/xsec" deps'xsec depsOr look up zip in your lockfile and compare the version with the ranges above.
How to fix it
Upgrade zip to 9.0.0 or later (cargo update -p zip; 9.x is a major version, check the changelog). Until then, do not call ZipArchive::extract on untrusted archives: iterate the entries yourself, skip symlinks, and write only to paths you build under a fresh temporary directory.
Sources
This list is curated by hand and kept short on purpose: it is not every known vulnerability, and a clean xsec deps does not mean no dependency has a flaw. Use your package manager's audit (npm audit, pip-audit, bundle audit) or Dependabot for the rest.