zip-rs zip2 EUVD-2026-109985

Exploitation requires (1) the target application to extract an attacker-supplied ZIP using ZipArchive::extract or ZipArchive::extract_unwrapped_root_dir on an affected version (7.2.0 through <9.0.0); ZipStreamReader::extract is NOT affected because local-header external_attributes are 0 so is_symlink() never returns true. (2) The attacker must know or guess the absolute path of the extraction destination (the basis for AC:H) - realistic for CI workspaces, /opt/app, or fixed Downloads paths. On Unix the escape needs a multi-stage symlink chain where an intermediate link resolves outside the destination. On Windows a single symlink suffices because simplified_components discards the drive/UNC Prefix (e.g. D:\<same tail> or \\attacker\share\<same tail>), but creating a symlink on Windows additionally requires the extracting process to hold SeCreateSymbolicLinkPrivilege (administrator rights or Developer Mode). Limiting factors: the AC:H path-knowledge requirement, the restriction to the two affected extract APIs, and on Windows the symlink-creation privilege requirement.

Severity signals are moderate-high and largely consistent. The supplied CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H, base 7.4) describes an unauthenticated, remotely-triggerable arbitrary file write with high integrity and availability impact but no confidentiality loss, and AC:H correctly reflects the one real precondition: the attacker must know or guess the absolute extraction path. The vuln.today decision label is 'this_week' (a prioritize-but-not-emergency tier), a vendor patch exists (v9.0.0), and the issue is reported by GitHub (GitHub_M). No CISA KEV listing and no EPSS score are present in the input, so there is no evidence of active or widespread exploitation - this is not a confirmed in-the-wild threat. However, the GHSA advisory documents a reporter-verified proof-of-concept (including real-hardware Windows 10 verification in tests/poc_win.rs and a two-stage symlink PoC that returns Ok(()) while writing outside the destination), so exploitability is demonstrated rather than theoretical. Net assessment: a genuine, patch-now-this-cycle supply-chain library flaw rather than a drop-everything emergency - the AC:H path-knowledge requirement and the write-only (not read) impact temper the raw CVSS, while the verified PoC and ubiquity of the crate in Rust ZIP handling raise it above a paper-only high-CVSS issue.

An attacker crafts a malicious ZIP whose entries include a symlink chain whose apparent target stays lexically under the extraction directory while an intermediate link resolves outside it, then delivers it to a target that extracts untrusted archives into a predictable path (a CI workspace, /opt/app, or a fixed Downloads directory). When the application calls ZipArchive::extract, the lexical prefix check passes and attacker-controlled files are created or overwritten outside the destination with the extracting process's privileges. A reporter-verified PoC exists (confirmed on a Windows 10 VM and via a two-stage symlink on other platforms); AC:H applies because the attacker must know or guess the absolute destination path.