zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in src/read/stream.rs. A crafted archive can therefore appear benign to a component that inspects the central directory but cause a streaming extractor to write a different attacker-selected path and content, potentially overwriting files used by a downstream service. This issue is fixed in version 9.0.5.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Public exploits 1
- foxcornlab/zip-cloaking-scanner PoC on GitHub
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
Change history 4
- StatusAwaiting Analysis → PublishedNVD modified 2026-10-26 16:24
- StatusPublished → Awaiting AnalysisNVD modified 2026-10-26 18:39
- StatusReceived → PublishedNVD modified 2026-10-26 16:24
- First seenCVSS 10.0NVD modified 2026-10-26 17:17
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.