{"aliases":["GHSA-4684-h2q9-2vcp"],"categories":["privilege-escalation"],"crate":"zip","cves":[],"cvss":0.0,"database_specific":{"severity":"critical"},"date":"2026-10-10","deb_packages":[{"crate_name":"czkawka-cli","deb_name":"czkawka-cli","version":"12.0.2-2"},{"crate_name":"czkawka-gui","deb_name":"czkawka-gui","version":"12.0.2-1"},{"crate_name":"icu4x-datagen","deb_name":"icu4x-datagen","version":"2.2.0-1+b2"},{"crate_name":"ognibuild","deb_name":"ognibuild","version":"0.2.21-1"},{"crate_name":"xleak","deb_name":"xleak","version":"0.2.6+dfsg-1+b1"}],"description":"`ZipStreamReader::extract()` applies Unix permissions through extracted symlinks without validating the symlink target stays within the destination\n\nFor further details see: https://github.com/zip-rs/zip2/security/advisories/GHSA-4684-h2q9-2vcp","id":"RUSTSEC-2026-0369","keywords":["privilege-escalation","symlink","permissions"],"patched_versions":[">=9.0.0"],"source":"debian_rustsec","title":"ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target","url":"https://rustsec.debian.net/advisories/RUSTSEC-2026-0369.html"}