{"id":"GHSA-vv5m-jxxh-4627","aliases":["RUSTSEC-2026-0367"],"status":"published","title":"Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation","description":"The `zip` crate preserves privileged Unix permission bits (SUID, SGID, and sticky bits) from ZIP `external_attributes` during extraction, instead of masking them to safe permission bits. If a privileged process (for example, `root` in an installer, CI/CD pipeline, or container build) extracts an attacker-controlled ZIP archive using `ZipArchive::extract()` or the stream extraction API, files can be created as setuid-root or setgid. This behavior allows the creation of SUID/SGID files during extraction, which can lead to local privilege escalation depending on the execution environment.\n\nFor further details see: https://github.com/zip-rs/zip2/security/advisories/GHSA-vv5m-jxxh-4627","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","from":"osv"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-10-09T12:00:00Z","modified":"2026-10-16T23:30:02Z","fixes":[{"ecosystem":"crates.io","package":"zip","fixed_in":["9.0.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"zip","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"9.0.0"}]}]}],"references":[{"url":"https://crates.io/crates/zip","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0367.html","tags":["advisory"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0367","title":" Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation","description":"The `zip` crate preserves privileged Unix permission bits (SUID, SGID, and sticky bits) from ZIP `external_attributes` during extraction, instead of masking them to safe permission bits. If a privileged process (for example, `root` in an installer, CI/CD pipeline, or container build) extracts an attacker-controlled ZIP archive using `ZipArchive::extract()` or the stream extraction API, files can be created as setuid-root or setgid. This behavior allows the creation of SUID/SGID files during extraction, which can lead to local privilege escalation depending on the execution environment.\n\nFor further details see: https://github.com/zip-rs/zip2/security/advisories/GHSA-vv5m-jxxh-4627","status":"published","published":"2026-10-09T12:00:00Z","modified":"2026-10-16T23:30:02.392172556Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:40.430679Z"}]}}