CVE-2026-115908: Arbitrary File Write via Lexical Symlink Validation Bypass in Rust zip Crate

Vulnerability ID: CVE-2026-115908
CVSS Score: 7.4
Published: 2026-10-29

CVE-2026-115908 (GHSA-hjqx-j4rw-g7xv) is a high-severity path traversal and link-following vulnerability in the Rust zip library (zip-rs/zip2) affecting versions >= 7.2.0 and < 9.0.0. Because ZipArchive::extract and ZipArchive::extract_unwrapped_root_dir validate symbolic link targets solely via lexical prefix comparisons rather than resolving intermediate filesystem links, an attacker who knows or can guess the absolute extraction path can construct multi-hop symlink chains that escape the destination directory, enabling arbitrary file creation and overwrite with the privileges of the extracting process.

TL;DR

Versions 7.2.0 through 8.6.0 (and 9.0.0 pre-releases) of the Rust zip crate validate extracted symlink targets lexically rather than resolving intermediate links on disk. An attacker who knows the target extraction directory path can use a two-hop symlink chain (or a single link abusing stripped drive/UNC prefixes on Windows) to write or overwrite arbitrary files outside the destination directory.

⚠️ Exploit Status: POC

Technical Details

• Vulnerability ID: CVE-2026-115908 / GHSA-hjqx-j4rw-g7xv
• Affected Component: zip crate (zip-rs/zip2) >= 7.2.0, < 9.0.0
• Weakness Class: CWE-59 (Link Following) / CWE-22 (Path Traversal) / CWE-61 (Symlink Following)
• CVSS v3.1 Score: 7.4 High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H)
• EPSS Score: 0.432% (37.51st Percentile)
• Impact: Arbitrary file creation and overwrite outside extraction root
• Exploit Status: PoC Available (Official regression test suite)
• CISA KEV Status: Not Listed

Affected Systems

• Rust applications and services using the zip crate (zip-rs/zip2) versions >= 7.2.0 and < 9.0.0
• Linux and Unix-like systems extracting archives to predictable destination paths via ZipArchive::extract or ZipArchive::extract_unwrapped_root_dir
• Windows systems running affected Rust binaries with SeCreateSymbolicLinkPrivilege (Administrator or Developer Mode)
• zip (zip2): >= 7.2.0, < 9.0.0 (Fixed in: 9.0.0)

Code Analysis

Commit: 09c030e

Replace lexical symlink validation with iterative component resolution (resolve_enclosed), enforce MAX_SYMLINK_HOPS, validate links at creation time, and properly compare Windows prefixes.

Replaces simplified_components prefix comparison in safe_prepare_path (src/read/zipfile.rs) with resolve_enclosed (src/path.rs) and adds upfront symlink target checks in make_symlink (src/read/mod.rs).

Exploit Details

• GitHub (Official Regression Test Suite): Functional Rust proof-of-concept test cases (tests/extract_symlink.rs) demonstrating two-hop symlink escape and ~/.ssh/authorized_keys overwrite.

Mitigation Strategies

• Upgrade the Rust zip crate dependency to version 9.0.0 or later.
• Replace ZipArchive::extract and ZipArchive::extract_unwrapped_root_dir with manual entry iteration that rejects symbolic links.
• Unpack untrusted archives inside isolated filesystem namespaces, containers, or randomized temporary directories.
• Remove SeCreateSymbolicLinkPrivilege from processes handling untrusted archives on Windows.

Remediation Steps:

1. Audit Cargo.lock across all Rust projects to identify zip crate versions >= 7.2.0 and < 9.0.0 (e.g., running cargo tree -i zip).
2. Update Cargo.toml to specify zip = ">=9.0.0" and run cargo update -p zip.
3. Rebuild and redeploy all affected binaries and services.
4. If remaining on 7.x or 8.x is temporarily required, refactor extraction routines to iterate entries manually via by_index, verify paths with enclosed_name(), and return an error if entry.is_symlink() is true.

References

• GitHub Security Advisory GHSA-hjqx-j4rw-g7xv
• GitHub Fix Commit 09c030eab56e8db8fb3c1c33f554407b30bad8fa
• zip-rs/zip2 Release v9.0.0
• NVD Vulnerability Detail: CVE-2026-115908
• CVE.org Record: CVE-2026-115908
• Official cvelistV5 JSON Record
• Wiz Vulnerability Database: CVE-2026-115908

Read the full report for CVE-2026-115908 on our website for more details including interactive diagrams and full exploit analysis.