Zip Cloaking: Rust zip crate — parser differential lets crafted ZIPs bypass security scanners and overwrite arbitrary files (CVE-2026-115905)
Severity: critical · Patch status: patched · Since 2026-10-28 · CVE-2026-115905
A critical parser differential in the Rust zip crate (<= 9.0.4) means ZipArchive trusts the Central Directory File Header while ZipStreamReader trusts the Local File Header, so a crafted archive can present different filenames and contents to different readers. Attackers can craft a ZIP whose CDFH declares a benign file (e.g. docreport.pdf) to pass WAF/AV/CDR inspection via ZipArchive, while backend extraction with ZipStreamReader::extract writes the LFH-declared path (e.g. cronworker.sh), enabling arbitrary file overwrite, DoS, and RCE. The shallowcopyfile API can also create dual-header desync. Fixed in zip 9.0.5; a full exploit-chain PoC is public. Any service accepting ZIP uploads and extracting with streaming readers is affected.
What to do
- Upgrade the zip crate to 9.0.5 immediately
- Audit upload pipelines for use of ZipStreamReader::extract/visit on untrusted archives
- Treat archives inspected with CDFH-based parsers as unverified if extraction uses streaming readers
- Add defense-in-depth: extract to isolated sandboxes and validate post-extraction paths
- Block or re-scan archives whose LFH/CDFH entries disagree
Fixed versions
Sources
All live incidents on Threat Watch
