Do Son 
A deceptive archive can easily pass security filters while secretly replacing vital server executables. Specifically, software maintainers uncovered the critical Rust zip vulnerability designated as CVE-2026-115905. This severe flaw earned a maximum severity score of 10.0 under the CVSS 4.0 scoring. Furthermore, the defect permits malicious actors to alter file paths between validation checks and extraction routines. Consequently, services that automatically ingest and decompress untrusted archives face immediate risks of remote system compromise.
- CVE: CVE-2026-115905
- CVSS: 10.0 (Critical · CVSSv4)
- Product: zip-rs zip2
- Affected: < 9.0.5
- Impact: zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE
- Status: No confirmed exploitation yet
- EPSS: 0.3% (30-day)
- Action: See vendor advisory
ZIP Architectural Asymmetry and Header Discrepancies
The core problem originates directly from the fundamental architecture of the ZIP container format. Standard specifications store file metadata in two distinct locations. First, a local header precedes the compressed payload data. Second, a central directory records comprehensive archive entries at the file tail. Although standard archives align both entries, crafted archives can define conflicting names.
Crucially, different reader implementations within the library trust separate data structures. For example, the standard ZipArchive component parses entries exclusively through the central directory. In contrast, the streaming ZipStreamReader extracts files sequentially by reading local headers. Therefore, an inspection gateway might validate an innocuous PDF entry in the central directory. Meanwhile, the actual decompression engine writes an executable script defined inside the local header.
Weaponizing Header Desynchronization in Automated Pipelines
Developers validated this exploit mechanism through automated verification tests. An inspection gateway approved an uploaded archive after verifying a safe document name. Subsequently, the decompression engine overwrote a critical operational script named cron_worker.sh. Furthermore, testing confirmed that malicious payload commands replaced the original file contents completely.
As detailed in the security advisory for the Rust zip crate, this desynchronization creates grave security consequences. If a scheduled background task executes the replaced script, attackers achieve arbitrary command execution under service account permissions. Additionally, destroying vital dependencies can trigger widespread operational outages across cloud environments.
Defensive Updates and Manual Hardening Requirements
Maintainers classified all versions up to 9.0.4 as vulnerable to this attack vector. Although version 9.0.5 introduced mitigations, header verification remains disabled by default. Applications must invoke enforce_header_consistency explicitly to activate protective checks. Moreover, early patches wrote files to disk before completing header comparisons.
To resolve these lingering issues, developers overhauled decompression workflows in version 9.1.3. As visible in the ZipStreamReader source implementation in stream.rs, the extractor now decompresses files into an isolated temporary folder. The runtime transfers files to destination paths only after validating header consistency. However, developers must still enable strict verification explicitly within their software configurations. Ultimately, simply upgrading the crate dependency without activating header enforcement leaves applications exposed to silent file overwrites.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
