CVE-2026-115905

Name of the Vulnerable Software and Affected Versions zip versions prior to 9.0.5

Description In the zip library for Rust, ZipArchive treats Central Directory File Header filenames as authoritative, whereas ZipStreamReader extracts using Local File Header filenames without reconciling duplicate metadata in src/read/stream.rs. A specially crafted archive can appear benign to components inspecting the central directory but cause a streaming extractor to write different attacker-selected paths and content, which may lead to the overwriting of files used by downstream services.

Recommendations Update to version 9.0.5.