{"schema":"threatline.record/2","record":{"id":"CVE-2026-115908","aliases":["GHSA-hjqx-j4rw-g7xv"],"summary":"zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (The defense against CVE-2025-29787 was broken in v7.2.0)","details":"zip is a zip library for Rust that supports reading and writing simple ZIP files. From 7.2.0 until 9.0.0, ZipArchive::extract and ZipArchive::extract_unwrapped_root_dir use safe_prepare_path in src/read/zipfile.rs and simplified_components in src/path.rs to validate symbolic link targets with a lexical prefix comparison rather than resolving each intermediate link. An attacker who knows or can guess the absolute extraction destination can create a chain whose apparent target remains under the destination while an intermediate symlink resolves outside it, allowing attacker-controlled files to be created or overwritten with the extracting process's privileges. On Windows, discarded drive and UNC prefixes can permit a single-link escape when the process has SeCreateSymbolicLinkPrivilege, such as through administrator rights or Developer Mode. This regression is distinct from CVE-2025-29787. This issue is fixed in version 9.0.0.","categories":["Unclassified"],"product":"zip2","vendor":"zip-rs","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115908","source_modified_at":"2026-10-26T19:36:11.803Z","fetched_at":"2026-10-26T23:45:56.352924Z","product":"zip2","vendor":"zip-rs","versions":[{"version":">= 7.2.0, < 9.0.0","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":7.4,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-26T16:34:29.328Z","modified_at":"2026-10-26T19:36:11.803Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-115908","fetched_at":"2026-10-26T23:45:56.352924Z","source_modified_at":"2026-10-26T19:36:11.803Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/zip-rs/zip2/security/advisories/GHSA-hjqx-j4rw-g7xv","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/zip-rs/zip2/commit/09c030eab56e8db8fb3c1c33f554407b30bad8fa","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/zip-rs/zip2/releases/tag/v9.0.0","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-26T19:29:37.466263Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-26T19:36:11.803Z","content_hash":"88a96588a932c5fd85a826033e312dbd65dcaa39468d7b509df8bc0db2893009"}}