Is CVE-2026-115908 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115908 being exploited in the wild.

How severe is CVE-2026-115908?

High severity, with a CVSS score of 7.4, published 26 October 2026.

Which products and versions are affected?

zip (crates.io) >= 7.2.0, < 9.0.0, SEMVER:introduced=7.2.0,fixed=9.0.0; Zip-Rs Zip 7.2.0 until 9.0.0.

Is there a fix for CVE-2026-115908?

Yes. zip (crates.io): upgrade to 9.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-115908 attacked?

It is attacked over the network.

Am I affected by CVE-2026-115908?

Check whether you run zip (crates.io) or Zip-Rs Zip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115908: zip symlink escape vulnerability in extract

Q: Is there a fix for CVE-2026-115908?

Yes. zip (crates.io): upgrade to 9.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-115908 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-115908?

Check whether you run zip (crates.io) or Zip-Rs Zip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115908 · Severity: high · CVSS 7.4 · Published 2026-10-26

The zip library for Rust, used to read and write ZIP files, contains a vulnerability in its file extraction functionality that allows malicious ZIP archives to write files outside their intended destination directory. An attacker can craft a ZIP file with a chain of symbolic links that trick the extraction process into writing attacker-controlled files with the privileges of the extracting process, bypassing containment checks. On Windows systems with symlink privileges, this can occur with a single symbolic link.

Technologies: zip (crates.io), Zip-Rs Zip. Vendors: crates.io, Zip-Rs.

Quick answers

Is CVE-2026-115908 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115908 being exploited in the wild.
How severe is CVE-2026-115908?: High severity, with a CVSS score of 7.4, published 26 October 2026.
Which products and versions are affected?: zip (crates.io) >= 7.2.0, < 9.0.0, SEMVER:introduced=7.2.0,fixed=9.0.0; Zip-Rs Zip 7.2.0 until 9.0.0.
Is there a fix for CVE-2026-115908?: Yes. zip (crates.io): upgrade to 9.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115908 attacked?: It is attacked over the network.
Am I affected by CVE-2026-115908?: Check whether you run zip (crates.io) or Zip-Rs Zip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

zip (crates.io): upgrade to 9.0.0 or later
```
cargo update -p zip
```

Technical details

ZipArchive::extract and related functions used lexical path comparison via safe_prepare_path and simplified_components to validate symbolic link targets, rather than actually resolving intermediate symlinks. An attacker can create a symlink chain where an intermediate link escapes the destination while the apparent target appears to remain within it. On Windows, discarded drive and UNC prefixes allow single-link escapes when the process has SeCreateSymbolicLinkPrivilege. The fix implements resolution-based containment checking that walks paths one component at a time and re-validates intermediate symlinks.

Affected products

zip-rs zip 7.2.0 until 9.0.0

Identifiers

CVE-2026-115908
GHSA-hjqx-j4rw-g7xv

Timeline

2026-10-26: disclosed
2026-10-09: patched: Fixed in version 9.0.0 released October 9, 2026

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.