Rust zip crate: setuid privilege escalation fixed in version 9.0.5
RUSTSEC-2026-0367 in the Rust zip crate (CVSS 7.3, fixed in 9.0.0) makes the reader copy setuid, setgid and sticky bits from the archive without masking them; a privileged process that unpacks a malicious file plants a setuid-root file. Nine days later, the same crate disclosed CVE-2026-115905, a CVSS 10.0 "zip cloaking" flaw where scanner and extractor read different entry names, allowing arbitrary file overwrite and remote code execution. Version 9.0.5 fixes both flaws; the Cosmonic writeup urges upgrading today and sandboxing extraction of untrusted ZIPs.
What happened
A writeup from Cosmonic detailed two flaws in the Rust zip crate, one of the most widely used libraries for opening .zip files in the language. The first (CVSS 7.3) plants files with elevated privileges when a privileged process unpacks a malicious ZIP. The second (CVSS 10.0), disclosed nine days later, allows overwriting system files and executing code.
Why it matters
Services that receive and extract user uploads are exposed, especially those running as root: one malicious upload can create a setuid-root file on the server. With the second flaw, the file can overwrite configuration and startup scripts and become remote code execution.
What to do
Upgrade the zip crate to version 9.0.5, which fixes both flaws. Review where untrusted ZIPs are extracted and run that extraction without root, inside a deny-by-default sandbox.
For the technical team
- CVE
- CVE-2026-115995
- Affected
- Projeto zip (Rust) zip (biblioteca de manipulação de arquivos ZIP em Rust) · zip crate versions up to 9.0.0-pre3 (flaw 1). The source lists no version range for flaw 2 (CVE-2026-115905).
- Exploitation
- No exploitation reported in the sources. The Cosmonic writeup, posted on r/netsec, demonstrates the flaws non-weaponized: archives containing inert text files, with no executable and no real privilege escalation.
- Fix
- Flaw 1 fixed starting in zip 9.0.0; version 9.0.5 fixes both flaws and is the version to pin. Additional mitigation: extract untrusted ZIPs without root and inside a deny-by-default sandbox.
- Vector
- Rust zip crate. Flaw 1 (RUSTSEC-2026-0367, CWE-732): the reader copies the setuid, setgid and sticky bits from the archive entry on extraction without masking them; the writer masks with & 0o777. Condition: a privileged process (form uploader, installer, CI/CD job, container build running as root) unpacks an attacker-crafted ZIP, planting a setuid-root file. Flaw 2 (CVE-2026-115905): ZipArchive trusts the central directory and read_zipfile_from_stream trusts the local header, with no reconciliation; the scanner sees one name and the extractor another, allowing arbitrary file overwrite and RCE.
- More details
- RUSTSEC-2026-0367 = GHSA-vv5m-jxxh-4627, CVSS 7.3 (high). CVE-2026-115905 = GHSA-m665-v7pm-7grj, CVSS 10.0 (critical), disclosed nine days after the first; the bugs are unrelated. Writeup example: the central directory says release-notes.txt while the local header says config/app.conf. Core thesis: memory-safe languages like Rust are not enough, and a deny-by-default, capability-driven sandbox contains RCE even in unpatched code.
Timeline
Writeup posted to r/netsec details the flaw and sandbox defense.
