CVE-2026-115908 zip-rs CVE debrief

Who should care

Defenders responsible for systems that extract zip files, especially in environments with automated processes or exposed services, should assess exposure and prioritize mitigation. This includes teams managing CI workspaces, fixed directory paths, or services that handle zip file extractions.

Why it matters

CVE-2026-115908 allows arbitrary file writes via symlink targets in the zip package, affecting versions 7.2.0 and later. Exploitation requires knowledge of the extraction destination path. The impact is significant on Windows, where a single symlink can be used. Defenders should prioritize patching, assess exposure, and consider monitoring and compensating controls.

• Verify patching or mitigation priority for exposed systems
• Assess exposure in environments with automated zip extraction
• Monitor for suspicious zip file extractions
• Consider compensating controls for systems with untrusted zip file inputs

Technical summary

The zip package's ZipArchive::extract method validates symlink targets lexically, allowing an attacker to write arbitrary files outside the extraction directory through a symlink. This requires the attacker to know or guess the absolute path of the extraction destination. On Windows, the impact extends further as a single symlink is enough to exploit the vulnerability without needing an intermediate symlink chain, although creating symlinks requires administrator rights or Developer Mode.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in environments where untrusted zip files are extracted. Systems using the zip package for extraction, particularly those with automated processes or exposed services, should be assessed for exposure.

Recommended defensive actions

• Assess exposure in environments where untrusted zip files are extracted
• Prioritize patching or mitigating the vulnerability
• Verify inventory for systems using the zip package for extraction
• Consider compensating controls for monitoring and exception tracking
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was verified in zip version 9.0.0-pre3. Affected versions include 7.2.0 and later. Real-hardware verification was conducted on Windows 10 VM (19045.26). The attacker must know or guess the absolute path of the extraction destination. Exploitation requires careful planning, especially in environments like CI workspaces or fixed directory paths. On Windows, a single symlink can be used without needing an intermediate chain, but creating symlinks requires administrator rights or Developer Mode. Evidence limits were not

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.