PT-2026-22048

CVE-2026-27800

Published

2026-02-25

Updated

2026-03-04

Description by

CVSS 3.1

7.4

High

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Zed versions prior to 0.224.4

Description A Zip Slip (Path Traversal) issue exists in the extension archive extraction functionality. The extract zip() function, located in crates/util/src/archive.rs, does not validate ZIP entry filenames for path traversal sequences, such as ../. This allows a malicious extension to write files outside of its designated sandbox directory by downloading and extracting a crafted ZIP archive.

Recommendations Update to version 0.224.4 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')

Related identifiers

CVE-2026-27800