zip2 Rust Crate CVE-2026-115905

Exploitation requires the consuming application to extract untrusted ZIP archives using the streaming ZipStreamReader (zip::unstable::stream), which writes files to disk using the unverified Local File Header filename; the standard random-access ZipArchive API, which reads the authoritative Central Directory, is not affected. The full security-control-bypass scenario additionally requires a decoupled deployment where an upstream component inspects the archive with a Central-Directory-first parser (ZipArchive or an equivalent AV/CDR/WAF scanner) and then hands the same archive to a ZipStreamReader-based extractor without enforcing header consistency. Limiting factors: ZipStreamReader is an explicitly unstable API, so default extraction patterns are typically unaffected; the attacker-chosen overwrite path must be reachable/writable by the extracting process; reaching RCE requires the overwritten file to be subsequently executed; and the crafted archive must be deliverable to the extraction pipeline, which in many real deployments is an authenticated upload endpoint.

Signals point to a genuinely high-priority but conditionally-exploitable flaw rather than a universal 10.0 emergency. The vendor/advisory CVSS 4.0 of 10.0 (AV:N/AC:L/PR:N/UI:N with VC:H/VI:H/VA:H/SC:H/SI:H/SA:L) assumes both a specific decoupled architecture (a CDFH-first scanner validating the archive separately from extraction) and downstream execution of an overwritten file to reach RCE. The reliable, directly-demonstrated primitive is a parser differential producing arbitrary file overwrite - Integrity and Availability impact - while the claimed Confidentiality/RCE (VC:H/SC:H) is an indirect consequence that requires an overwritten script or binary to subsequently execute. The SSVC/priority Decision label is act_now and a complete reproducible PoC is published, which justifies prompt patching; however, no EPSS score was provided and the CVE is not in CISA KEV, so there is no evidence of widespread active exploitation at analysis time - the urgency derives from severity plus public PoC, not confirmed in-the-wild use. Important scope caveat: only applications extracting untrusted archives via the streaming ZipStreamReader (zip::unstable::stream) are affected; the common random-access ZipArchive path is not, so the headline 10.0 overstates real-world risk for most consumers of the crate. Conflict to note: the 'Information Disclosure' tag contradicts the actual integrity/overwrite nature of the bug.

An attacker crafts a single-entry ZIP whose Central Directory declares a benign name (e.g. doc_report.pdf) while the Local File Header declares a sensitive path (e.g. cron_worker.sh). An upload gateway that inspects the archive with ZipArchive (central-directory authoritative) sees only the benign PDF and approves it, but a backend worker extracting with ZipStreamReader writes using the Local File Header name, overwriting the targeted file with attacker content. A complete, reproducible proof-of-concept integration test demonstrating this full gateway-bypass → overwrite → RCE/DoS chain is embedded in the GHSA advisory.