Rust zip crate flaw lets crafted archives overwrite files

The Rust `zip2` crate is affected by CVE-2026-115905, a ZIP header inconsistency vulnerability rated 10.0 Critical under CVSS 4.0. Versions up to and including 9.0.4 are vulnerable. The crate’s standard `ZipArchive` reader uses entries in the archive’s central directory, while `ZipStreamReader` extracts files using local headers before the compressed data.

A crafted archive can give those two headers different filenames, allowing a gateway that checks the central directory to approve a harmless-looking file while extraction writes to a different path.

The vendor’s security advisory describes automated tests in which extraction overwrote `cron_worker.sh` with attacker-controlled content. If a scheduled task then runs the replaced script, an attacker could execute commands with the service account’s permissions. The advisory’s findings demonstrate the attack mechanism; the source says there has been no confirmed exploitation.

Version 9.0.5 introduced mitigations, but header consistency checks are disabled by default and must be enabled with `enforce_header_consistency`. According to the advisory, early patches could write files before comparing headers. Version 9.1.3 changed extraction to use an isolated temporary folder and transfer files to their destination only after checking header consistency; strict verification still needs to be enabled explicitly.