Vulnerability RUSTSEC-2026-0369
Critical
CRITICAL RISK
CVSS Score: 9.1
Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
6 days ago
October 10, 2026 at 12:00 PM UTC
ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target
0.0.1 - 9.0.0-pre3
0.0.1 - 9.0.0-pre3
Summary
ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target
Details
ZipStreamReader::extract() applies Unix permissions through extracted symlinks without validating the symlink target stays within the destination
For further details see: https://github.com/zip-rs/zip2/security/advisories/GHSA-4684-h2q9-2vcp
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
7 days ago
Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation
0.0.1 - 9.0.0-pre3 RUSTSEC-2026-0367
0.0.1 - 9.0.0-pre3 RUSTSEC-2026-0367
Unknown
7 days ago
zip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination directory
0.0.1 - 9.0.0-pre3 RUSTSEC-2026-0368
0.0.1 - 9.0.0-pre3 RUSTSEC-2026-0368
High Risk
1 year ago
zip Incorrectly Canonicalizes Paths during Archive Extraction Leading to Arbitrary File Write
1.3.0 - 2.2.3 GHSA-94vh-gphv-8pm8
1.3.0 - 2.2.3 GHSA-94vh-gphv-8pm8
Unknown
1 year ago
Incorrect path canonicalization during Archive Extraction Leading to Arbitrary File Write
1.3.0 - 2.2.3 RUSTSEC-2025-0168
1.3.0 - 2.2.3 RUSTSEC-2025-0168
Impacted packages
Timeline
Published
6 days ago
October 10, 2026 at 12:00 PM UTC
Fixed (9.0.0)
7 days ago
October 09, 2026 at 04:48 AM UTC
Last Modified
4 hours ago
October 16, 2026 at 11:30 PM UTC