Rust zip crate CVE-2026-115905 (GHSA-m665-v7pm-7grj, critical): ZipArchive and ZipStreamReader disagree on file names ('zip cloaking'), so an archive that passes a scan can extract different files. Which version fixes it?

What it is: every file in a ZIP archive is named twice: in a local header before its data and in the central directory at the end. In the Rust zip crate (zip-rs/zip2) up to 9.0.4, ZipArchive trusted only the central directory, while ZipStreamReader extracted using only the local headers. A crafted archive can therefore show one list of files to code that inspects it with ZipArchive and write different paths and contents when extracted with ZipStreamReader. Programs that check an upload with one reader and unpack it with the other can be tricked into writing files they meant to reject, which can lead to overwriting files and, depending on what is overwritten, code execution. Published October 28, 2026. Am I affected: - Your Rust project depends on zip <= 9.0.4: cargo tree -i zip (it is often transitive). - Highest risk: services that accept ZIP files from users or the network and extract them with ZipStreamReader, or that validate with one reader and extract with the other. Fix: 1. Upgrade to zip 9.0.5 or later (cargo update -p zip, or raise the version in Cargo.toml), rebuild and redeploy. Run cargo audit to catch other vulnerable crates. 2. Until then, validate and extract with the same reader, and prefer ZipArchive for untrusted archives; reject archives whose local-header and central-directory names differ. 3. Extract untrusted archives into an empty temporary directory as an unprivileged user, never directly over application or config folders, and check resulting paths stay inside it. Verify: cargo tree -i zip shows 9.0.5+ only, and cargo audit reports no RUSTSEC/GHSA entry for zip. Sources: https://github.com/zip-rs/zip2/security/advisories/GHSA-m665-v7pm-7grj https://nvd.nist.gov/vuln/detail/CVE-2026-115905 https://github.com/zip-rs/zip2/releases/tag/v9.0.5