Public PoC Exploit Disclosed for Critical Rust zip Crate Vulnerability
TL;DR
Maintainers of the zip2 repository have publicly disclosed technical details and working proof-of-concept (PoC) exploit code for a critical Rust zip crate vulnerability. Tracked as CVE-2026-115905 (CVSS v4.0: 10.0), this Zip Cloaking flaw lets attackers bypass security scanners, overwrite arbitrary files, and execute remote code. Developers must upgrade their dependencies to zip version 9.0.5 immediately.
Why It Matters
The zip crate is the standard archive-handling library for Rust, with hundreds of millions of downloads on crates.io across cloud microservices and backend workers. However, exact counts of vulnerable production deployments are not specified in the vendor advisory.
Because full vulnerability details and an automated PoC exploit test are now public, decoupled ingestion pipelines face immediate risk. Specifically, architectures that inspect uploads at a security gateway before extracting them via streaming readers can suffer arbitrary file overwrites, service destruction, and remote code execution. While a working PoC exploit is publicly available, no active exploitation in the wild has been confirmed.
How the Attack Works
According to the GitHub security advisory, this Rust zip crate vulnerability stems from an architectural parser differential (CWE-436) between random-access readers and streaming extractors.
Dual-Header Desynchronization and Gateway Evasion
In the PKWARE ZIP format, every file entry stores its metadata in two places: the Local File Header (LFH) preceding the payload and the Central Directory File Header (CDFH) at the end of the archive. In affected versions, ZipArchive reads filenames exclusively from the CDFH table and ignores the LFH. Conversely, ZipStreamReader::visit and ZipStreamReader::extract read sequentially from the stream and write files to disk using the unverified LFH filename. Furthermore, the library’s shallow_copy_file API directly constructs these dual-header mismatches.
In the publicly disclosed PoC exploit scenario, an attacker crafts an archive where the CDFH declares a harmless filename like doc_report.pdf, while the LFH declares cron_worker.sh. First, upstream antivirus scanners or web application firewalls inspecting the CDFH via ZipArchive approve the file as a clean PDF. Next, when a backend worker extracts the archive using ZipStreamReader::extract, it reads the LFH and overwrites the server’s legitimate cron_worker.sh script with a malicious payload.
Affected Versions
This Rust zip crate vulnerability affects all versions of the zip package up to and including 9.0.4. Version 9.0.5 is unaffected.
Patch and Mitigation Steps
Remediation developer ByGh00st and reviewer Pr0methean resolved CVE-2026-115905 in zip version 9.0.5. Developers should update their Cargo.toml manifests to require version 9.0.5 or newer and rebuild all affected Rust binaries immediately. If an immediate upgrade is impossible, teams should avoid using ZipStreamReader on untrusted archives and ensure that security gateways validate both Local File Headers and Central Directory headers before extraction.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
