{"aliases":["GHSA-4v9h-p7m9-rh26"],"categories":["privilege-escalation"],"crate":"zip","cves":[],"cvss":0.0,"database_specific":{"severity":""},"date":"2026-10-09","deb_packages":[{"crate_name":"czkawka-cli","deb_name":"czkawka-cli","version":"12.0.2-2"},{"crate_name":"czkawka-gui","deb_name":"czkawka-gui","version":"12.0.2-1"},{"crate_name":"icu4x-datagen","deb_name":"icu4x-datagen","version":"2.2.0-1+b2"},{"crate_name":"ognibuild","deb_name":"ognibuild","version":"0.2.21-1"},{"crate_name":"xleak","deb_name":"xleak","version":"0.2.6+dfsg-1+b1"}],"description":"In `zip` 9.0.0-pre2, `ZipArchive::extract` creates a symbolic link from an archive entry after validating only the output entry path. The link target bytes are passed directly to the platform symlink API, so a malicious archive can create an entry inside the destination that resolves to an attacker-chosen path outside it. This behavior was verified on macOS and Linux. On either platform, a subsequent application read or write through that extracted entry accesses the external target with the extracting process's permissions.\n\nFor further details see: https://github.com/zip-rs/zip2/security/advisories/GHSA-4v9h-p7m9-rh26","id":"RUSTSEC-2026-0368","keywords":["privilege-escalation","symlink"],"patched_versions":[">=9.0.0"],"source":"debian_rustsec","title":"zip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination directory","url":"https://rustsec.debian.net/advisories/RUSTSEC-2026-0368.html"}