CVE-2026-115908: 
Linux Ubuntu vulnerability analysis and mitigation

CVE-2026-115908 is a symlink-based path traversal vulnerability in the zip2 Rust crate (crate name: zip) that allows arbitrary file creation or overwrite outside the intended extraction directory. It affects versions 7.2.0 through 8.x (all versions >= 7.2.0, < 9.0.0) of the zip-rs/zip2 package. The vulnerability was published on October 26, 2026, and is distinct from — though related to — the earlier CVE-2025-29787, as the protection introduced for that CVE was inadvertently broken in v7.2.0. It carries a CVSS v3.1 base score of 7.4 (High) (GitHub Advisory, Feedly).

The root cause is improper symlink resolution during ZIP extraction, classified under CWE-22 (Path Traversal), CWE-59 (Improper Link Resolution Before File Access), and CWE-61 (UNIX Symbolic Link Following). The safe_prepare_path function in src/read/zipfile.rs validates symlink targets using simplified_components in src/path.rs, which performs only a lexical prefix comparison rather than resolving each intermediate symlink component against the filesystem. A regression introduced in commit d5cf4b55 (released in v7.2.0) changed simplified_components to silently strip absolute path prefixes (drive letters, UNC paths, root directory components) instead of rejecting them, allowing absolute symlink targets to pass the containment check. An attacker can craft a ZIP archive with a two-stage symlink chain: a first symlink (b) pointing to an absolute path outside the destination (created without validation), and a second symlink (a) whose target lexically appears to be inside the destination but traverses b as an intermediate component, causing subsequent file writes to land outside the extraction directory. On Windows, the simplified_components function discards drive and UNC prefixes, so a single symlink with a matching path tail on a different volume is sufficient to escape, provided the process holds SeCreateSymbolicLinkPrivilege. A public PoC is included in the GitHub Security Advisory (GitHub Advisory, Fix Commit).

Successful exploitation allows an attacker to write files with arbitrary content to any path writable by the extracting process, outside the intended extraction directory. This can result in overwriting sensitive files such as ~/.ssh/authorized_keys, .bashrc, .git/hooks/*, CI configuration files, or service binaries, potentially leading to remote code execution or privilege escalation. Destruction of critical files can also cause denial of service. Critically, extract() returns Ok(()) with no error, so the calling application has no straightforward way to detect the attack. The impact is limited to integrity and availability (no confidentiality impact), and exploitation requires the attacker to know or guess the absolute path of the extraction destination (GitHub Advisory).

No in-the-wild exploitation has been reported, and the CVE's NVD SSVC assessment lists exploitation as "none" at time of publication. The EPSS score is approximately 0.43%, reflecting low but non-negligible probability of exploitation. No exploit kits or threat actor attribution are associated with this CVE. However, a detailed proof-of-concept (PoC) is publicly available in the GitHub Security Advisory, covering both Linux (two-hop symlink chain) and Windows (single-symlink drive/UNC escape) scenarios. Exploitation requires the attacker to know or guess the absolute extraction path (AC:H), which is realistic in predictable environments such as CI pipelines, fixed application directories (e.g., /opt/app), or standard download paths (GitHub Advisory, Feedly).

1. Reconnaissance: Identify applications that use the zip2 Rust crate (versions 7.2.0–8.x) to extract untrusted ZIP archives, and determine or guess the absolute path of the extraction destination (e.g., /opt/app/uploads/extracted/, a CI workspace path, or a fixed downloads directory).
2. Craft malicious ZIP — Linux/Unix (two-hop chain):
   • Add a symlink entry named b pointing to an absolute path outside the destination (e.g., /home/victim/.ssh). This symlink is created without validation.
   • Add a symlink entry named a pointing to <dest>/b/.ssh (lexically appears inside the destination, passes the prefix check).
   • Add a regular file entry a/authorized_keys with attacker-controlled content (e.g., an attacker SSH public key).
3. Craft malicious ZIP — Windows (single-symlink):
   • Determine the canonical tail of the extraction destination path.
   • Add a symlink entry named a pointing to an absolute path on a different drive or UNC share that shares the same tail as the destination (e.g., D:\<same-tail>\evil). The simplified_components function discards the drive prefix, so the lexical check passes.
   • Add a regular file entry a/pwned.txt with attacker-controlled content.
4. Deliver the archive: Supply the crafted ZIP to the target application through any available input channel (file upload, package distribution, CI artifact, etc.).
5. Trigger extraction: The application calls ZipArchive::extract() or ZipArchive::extract_unwrapped_root_dir(). The OS resolves the intermediate symlink transparently, writing the attacker's file outside the extraction directory. The function returns Ok(()) with no error.
6. Achieve objective: Depending on the overwritten file, the attacker may gain persistent access (e.g., via SSH authorized keys), execute arbitrary code (e.g., via git hooks or service binaries), or cause denial of service (GitHub Advisory).

• File System: Unexpected files appearing outside the designated extraction directory, particularly in sensitive locations such as ~/.ssh/authorized_keys, ~/.bashrc, .git/hooks/, /etc/, or application binary/config directories; newly created symlinks within the extraction directory pointing to paths outside it.
• File System (Windows): Symlinks within the extraction directory whose targets reference a different drive letter or UNC share path.
• Logs: Application logs showing ZipArchive::extract returning Ok(()) for archives containing symlink entries with absolute path targets; filesystem audit logs recording file creation or modification events outside the extraction directory initiated by the extracting process.
• Process: The process performing ZIP extraction creating files in unexpected filesystem locations; unusual modification timestamps on sensitive files coinciding with extraction events.
• Network: Delivery of ZIP archives from untrusted or unexpected sources to services that perform automatic extraction (GitHub Advisory).

Upgrade the zip2 crate to version 9.0.0, which replaces the flawed lexical prefix comparison with a resolution-based containment check (resolve_enclosed) that walks each path component and follows symlinks against the filesystem, rejecting any that escape the destination directory. The fix also hardens make_symlink to validate symlink targets before creation. No configuration-based workaround is available for the vulnerable versions; the only effective remediation is upgrading. Applications that cannot upgrade immediately should avoid extracting untrusted ZIP archives using ZipArchive::extract or ZipArchive::extract_unwrapped_root_dir, or should perform post-extraction validation of all created files and symlinks (GitHub Advisory, Fix Commit, v9.0.0 Release).

The vulnerability was discovered and reported by security researcher sl91994, with the advisory published by maintainer Pr0methean on October 22, 2026. The advisory explicitly notes the regression history — that the protection for CVE-2025-29787 was inadvertently removed by a commit intended to support extracting archives with absolute path names — and includes detailed PoC code for both Linux and Windows. No significant broader media coverage or notable social media commentary beyond the GitHub advisory and standard vulnerability aggregator listings has been identified at this time (GitHub Advisory).