{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/zip/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:zip-rs:zip2:*:*:*:*:*:rust:*:*"],"_cs_cves":[{"id":"CVE-2026-115905"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["zip2 (\u003c 9.0.5)"],"_cs_severities":["critical"],"_cs_tags":["zip","rust","vulnerability","rce","file-overwrite"],"_cs_type":"advisory","_cs_vendors":["zip-rs"],"content_html":"\u003cp\u003eCVE-2026-115905 affects the \u003ccode\u003ezip\u003c/code\u003e crate in the Rust \u003ccode\u003ezip-rs/zip2\u003c/code\u003e ecosystem. The vulnerability arises from differential parsing where \u003ccode\u003eZipArchive\u003c/code\u003e relies on the Central Directory File Header (CDFH) for file metadata, while \u003ccode\u003eZipStreamReader\u003c/code\u003e relies on the Local File Header (LFH). An attacker can craft a ZIP archive where the CDFH points to a benign file to bypass gateway security inspections, but the LFH directs the extraction to a sensitive path, resulting in an arbitrary file overwrite or potential RCE.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker crafts a malicious ZIP archive with mismatched CDFH and LFH filenames.\u003c/li\u003e\n\u003cli\u003eCDFH is configured to contain a benign filename (e.g., doc_report.pdf).\u003c/li\u003e\n\u003cli\u003eLFH is configured to contain a malicious path (e.g., /home/user/.ssh/authorized_keys or a system startup script).\u003c/li\u003e\n\u003cli\u003eThe victim or a gateway security appliance inspects the ZIP archive using a parser that only validates the CDFH.\u003c/li\u003e\n\u003cli\u003eThe security inspection concludes the archive is safe.\u003c/li\u003e\n\u003cli\u003eThe target application uses \u003ccode\u003eZipStreamReader\u003c/code\u003e to extract the archive.\u003c/li\u003e\n\u003cli\u003eThe streaming extractor follows the LFH and overwrites a critical system or application file with attacker-controlled content.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary file overwrites, leading to potential Remote Code Execution (RCE) or security control bypass.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch all projects using the Rust \u003ccode\u003ezip\u003c/code\u003e crate by updating the dependency to version 9.0.5 or newer.\u003c/li\u003e\n\u003cli\u003eAudit existing infrastructure for applications that perform streaming extraction of user-supplied ZIP archives.\u003c/li\u003e\n\u003cli\u003eUntil patching is possible, implement validation logic that reconciles CDFH and LFH filenames before initiating extraction.\u003c/li\u003e\n\u003cli\u003eDeploy the triage scanner provided by \u003ccode\u003efoxcornlab\u003c/code\u003e to audit \u003ccode\u003eCargo.lock\u003c/code\u003e and suspicious ZIP archives for header mismatches.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-27T09:20:19Z","date_published":"2026-10-27T09:20:19Z","id":"https://feed.craftedsignal.io/briefs/2026-10-zip-cloaking-vulnerability/","summary":"CVE-2026-115905 is a critical vulnerability in the Rust zip crate (versions \u003c= 9.0.4) allowing arbitrary file overwrites or RCE via ZIP header discrepancy between CDFH and LFH.","title":"Rust zip-rs/zip2: Arbitrary file overwrite and RCE via ZIP header mismatch (CVE-2026-115905)","url":"https://feed.craftedsignal.io/briefs/2026-10-zip-cloaking-vulnerability/"}],"language":"en","title":"CraftedSignal Threat Feed - Zip","version":"https://jsonfeed.org/version/1.1"}