zip vulnerabilities
CVEs whose affected-version data names the zip package (rust). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
6 CVEsRSS
CVE-2026-115905Critical· 10.0PoCzip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE
zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE
RUSTSEC-2026-0369Critical· 9.1ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target
ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target
RUSTSEC-2026-0368Nonezip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination directory
zip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination directory
RUSTSEC-2026-0367High· 7.3Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation
Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation
CVE-2025-29787HighIncorrect path canonicalization during Archive Extraction Leading to Arbitrary File Write
Incorrect path canonicalization during Archive Extraction Leading to Arbitrary File Write
CVE-2018-13410Critical· 9.8PoCInfo-ZIP Zip 3.0, when the -T and -TT command-line options are used, allows attackers to cause a denial of service (invalid free and application crash) or possibly have unspecified other impact because of an off-by-one error
Info-ZIP Zip 3.0, when the -T and -TT command-line options are used, allows attackers to cause a denial of service (invalid free and application crash) or possibly have unspecified other impact because of an off-by-one error. NOTE: it is…