CVE-2026-115905 with a CVSS score of 10.0 is a critical parser differential and security control bypass vulnerability in the zip crate, affecting versions ≤ 9.0.4, caused by inconsistent handling of ZIP archive headers. The random-access reader ZipArchive treats the Central Directory File Header as authoritative and ignores the filename in the Local File Header, while the streaming reader ZipStreamReader relies exclusively on the Local File Header when extracting files. An attacker can exploit this over a network by crafting a ZIP archive whose central directory declares a benign filename, such as a document, while the local file header declares a malicious executable or script path. When a security gateway or content inspection component parses the archive using the central-directory-based reader, it may approve the file, but a backend extraction process using the streaming reader can write the attacker-controlled filename to the filesystem. This enables arbitrary file overwrite, replacement of production scripts, denial of service, and remote code execution. The impact is severe because a single uploaded archive can evade inspection, implant a backdoor, and compromise confidentiality, integrity, and availability of affected systems.
We recommend you to update zip to version 9.0.5.[/subscribe_to_unlock_form]
CVE-2026-115905 with a CVSS score of 10.0 is a critical parser differential and security control bypass vulnerability in the zip crate, affecting versions ≤ 9.0.4, caused by inconsistent handling of ZIP archive headers. The random-access reader ZipArchive treats the Central Directory File Header as authoritative and ignores the filename in the Local File Header, while the streaming reader ZipStreamReader relies exclusively on the Local File Header when extracting files. An attacker can exploit this over a network by crafting a ZIP archive whose central directory declares a benign filename, such as a document, while the local file header declares a malicious executable or script path. When a security gateway or content inspection component parses the archive using the central-directory-based reader, it may approve the file, but a backend extraction process using the streaming reader can write the attacker-controlled filename to the filesystem. This enables arbitrary file overwrite, replacement of production scripts, denial of service, and remote code execution. The impact is severe because a single uploaded archive can evade inspection, implant a backdoor, and compromise confidentiality, integrity, and availability of affected systems.
We recommend you to update zip to version 9.0.5.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]