External risk intelligence

Zip Archive Path Traversal Via Metadata Mismatch

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-115905

This is a vulnerability in a Rust software library (zip-rs) used for file processing. Libraries are build-time dependencies incorporated into applications by developers. They are not independently deployed services or internet-facing network appliances, making direct public internet exposure of the library itself impossible.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the zip library for Rust could allow a specially crafted archive to overwrite files used by downstream services. This occurs because the library may not reconcile duplicate metadata when extracting files from a zip archive, leading to a discrepancy between how a component inspects the archive and how it is actually extracted.

Archive processing logic can be tricked.
Affects downstream file overwrites.
Confirm relevance and any exposure.

Attack Path

How an attacker could exploit the issue

An attacker could leverage a specially crafted ZIP archive to trick a Rust application that uses the zip library. The attacker's archive would appear safe to one part of the library but would cause another part to extract its contents to an unexpected location, potentially overwriting important files.

Archive delivered via network.
Crafted ZIP archive triggers misinterpretation.
Risk of unauthorized file overwrite.

Live Threat

Current exploitation, exposure, and threat context

A crafted ZIP archive could trick a Rust-based zip library into extracting files to an attacker-controlled location, potentially overwriting critical files used by a downstream service when processing the archive.

Potentially overwrite service files.
Crafted archive allows path manipulation.
Downstream service disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

The `zip` library's vulnerability impacts applications that process ZIP archives. Application owners and development teams are responsible for identifying their use of this library. The first step is to audit build dependencies to locate all applications that incorporate the `zip` library and assess their exposure based on whether they handle untrusted archives and their criticality.

Identify applications using the library.
Verify untrusted archive processing.
Plan for library updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the zip library for Rust?

The zip library is a code package developers use to build Rust applications that read, write, and extract ZIP files. It serves as a foundational tool for programs that handle compressed data archives, providing the necessary logic to parse the internal structure of these files so the software can interact with the contents.

What does CVE-2026-115905 mean for file integrity?

This vulnerability, involving Improper Input Validation (CWE-20) and Interpretation Conflict (CWE-436), happens when the library processes a ZIP file with conflicting metadata. Because it extracts files using a different header than it uses to inspect them, an attacker can manipulate the path of an extracted file. This allows the file to be written to an unintended location on the host system, potentially overwriting existing, legitimate files.

How can an attacker trigger this vulnerability?

An attacker must provide a specially crafted ZIP archive to an application using the affected library. The bug relies on the library's inconsistent handling of metadata; it does not trigger if the application only reads the central directory or uses a correctly implemented extraction process that reconciles all metadata headers before writing data to the disk.

Is my software affected by this vulnerability?

According to Halo Surface Signal, this library is a build-time dependency integrated by developers, not an independently deployed network service. Because it is embedded code, direct public internet exposure is not possible. You should care if your organization develops or maintains Rust applications that process ZIP archives from external or untrusted sources.

What is the first step to address this issue?

The primary response is to audit your application dependencies to confirm if you are using version 9.0.4 or earlier of the zip library. If you find the library in your codebase, evaluate whether those specific applications process ZIP files provided by untrusted users. If they do, plan to update to version 9.0.5 to incorporate the corrected metadata reconciliation logic.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.