{"id":"GHSA-4684-h2q9-2vcp","aliases":["RUSTSEC-2026-0369"],"status":"published","title":"ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target","description":"`ZipStreamReader::extract()` applies Unix permissions through extracted symlinks without validating the symlink target stays within the destination\n\nFor further details see: https://github.com/zip-rs/zip2/security/advisories/GHSA-4684-h2q9-2vcp","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical","from":"osv"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-10-10T12:00:00Z","modified":"2026-10-16T23:30:02Z","fixes":[{"ecosystem":"crates.io","package":"zip","fixed_in":["9.0.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"zip","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"9.0.0"}]}]}],"references":[{"url":"https://crates.io/crates/zip","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0369.html","tags":["advisory"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0369","title":"ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target","description":"`ZipStreamReader::extract()` applies Unix permissions through extracted symlinks without validating the symlink target stays within the destination\n\nFor further details see: https://github.com/zip-rs/zip2/security/advisories/GHSA-4684-h2q9-2vcp","status":"published","published":"2026-10-10T12:00:00Z","modified":"2026-10-16T23:30:02.387698467Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:40.430679Z"}]}}