{"aliases":["GHSA-vv5m-jxxh-4627"],"categories":["privilege-escalation"],"crate":"zip","cves":[],"cvss":0.0,"database_specific":{"severity":"high"},"date":"2026-10-09","deb_packages":[{"crate_name":"czkawka-cli","deb_name":"czkawka-cli","version":"12.0.2-2"},{"crate_name":"czkawka-gui","deb_name":"czkawka-gui","version":"12.0.2-1"},{"crate_name":"icu4x-datagen","deb_name":"icu4x-datagen","version":"2.2.0-1+b2"},{"crate_name":"ognibuild","deb_name":"ognibuild","version":"0.2.21-1"},{"crate_name":"xleak","deb_name":"xleak","version":"0.2.6+dfsg-1+b1"}],"description":"The `zip` crate preserves privileged Unix permission bits (SUID, SGID, and sticky bits) from ZIP `external_attributes` during extraction, instead of masking them to safe permission bits. If a privileged process (for example, `root` in an installer, CI/CD pipeline, or container build) extracts an attacker-controlled ZIP archive using `ZipArchive::extract()` or the stream extraction API, files can be created as setuid-root or setgid. This behavior allows the creation of SUID/SGID files during extraction, which can lead to local privilege escalation depending on the execution environment.\n\nFor further details see: https://github.com/zip-rs/zip2/security/advisories/GHSA-vv5m-jxxh-4627","id":"RUSTSEC-2026-0367","keywords":["privilege-escalation","suid","sgid"],"patched_versions":[">=9.0.0"],"source":"debian_rustsec","title":"Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation","url":"https://rustsec.debian.net/advisories/RUSTSEC-2026-0367.html"}