What is the CVSS score of CVE-2026-27800?

CVE-2026-27800 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Zed are affected by CVE-2026-27800?

Zed code editor contains a critical path traversal vulnerability in its extension installation feature that could allow attackers to overwrite arbitrary files on affected systems.

Is there a public PoC exploit available for CVE-2026-27800?

Yes, a public proof-of-concept exploit is available for CVE-2026-27800. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-27800?

Within 24 hours: Disable Zed extension functionality organization-wide via configuration management and notify all users. Within 7 days: Audit systems for unauthorized file modifications and assess which development teams depend on Zed extensions. Within 30 days: Develop a secure extension approval process, implement file integrity monitoring on development systems, and prepare to deploy the patch immediately upon vendor release.

Zed CVE-2026-27800

HIGH

Path Traversal (CWE-22)

2026-02-26 security-advisories@github.com

Path Traversal Zed

7.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.4 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Mar 04, 2026 - 03:16 vuln.today

Public exploit code

CVE Published

Feb 26, 2026 - 00:16 nvd

HIGH 7.4

DescriptionGitHub Advisory

Zed, a code editor, has a Zip Slip (Path Traversal) vulnerability exists in its extension archive extraction functionality prior to version 0.224.4. The extract_zip() function in crates/util/src/archive.rs fails to validate ZIP entry filenames for path traversal sequences (e.g., ../). This allows a malicious extension to write files outside its designated sandbox directory by downloading and extracting a crafted ZIP archive. Version 0.224.4 fixes the issue.

AnalysisAI

Zed code editor versions prior to 0.224.4 contain a path traversal vulnerability in ZIP extraction that fails to sanitize malicious filenames, allowing attackers to write files outside the intended sandbox directory through crafted extension archives. Public exploit code exists for this vulnerability. An attacker can exploit this by distributing a malicious extension that, when installed, deposits files in arbitrary locations on the affected system.

Technical ContextAI

Classified as CWE-22 (Path Traversal). Affects Zed. Zed, a code editor, has a Zip Slip (Path Traversal) vulnerability exists in its extension archive extraction functionality prior to version 0.224.4. The extract_zip() function in crates/util/src/archive.rs fails to validate ZIP entry filenames for path traversal sequences (e.g., ../). This allows a malicious extension to write files outside its designated sandbox directory by downloading and extracting a crafted ZIP archive. Version 0.224.4 fixes the issue.

RemediationAI

Monitor vendor advisories for a patch. Validate and sanitize file path inputs. Use allowlists. Restrict network access to the affected service where possible.