rustsec-2026-0367

{
  "aliases": [
    "GHSA-vv5m-jxxh-4627"
  ],
  "categories": [
    "privilege-escalation"
  ],
  "crate": "zip",
  "cves": [],
  "cvss": 0.0,
  "database_specific": {
    "severity": "high"
  },
  "date": "2026-10-09",
  "deb_packages": [
    {
      "crate_name": "czkawka-cli",
      "deb_name": "czkawka-cli",
      "version": "12.0.2-2"
    },
    {
      "crate_name": "czkawka-gui",
      "deb_name": "czkawka-gui",
      "version": "12.0.2-1"
    },
    {
      "crate_name": "icu4x-datagen",
      "deb_name": "icu4x-datagen",
      "version": "2.2.0-1+b2"
    },
    {
      "crate_name": "ognibuild",
      "deb_name": "ognibuild",
      "version": "0.2.21-1"
    },
    {
      "crate_name": "xleak",
      "deb_name": "xleak",
      "version": "0.2.6+dfsg-1+b1"
    }
  ],
  "description": "The `zip` crate preserves privileged Unix permission bits (SUID, SGID, and sticky bits) from ZIP `external_attributes` during extraction, instead of masking them to safe permission bits. If a privileged process (for example, `root` in an installer, CI/CD pipeline, or container build) extracts an attacker-controlled ZIP archive using `ZipArchive::extract()` or the stream extraction API, files can be created as setuid-root or setgid. This behavior allows the creation of SUID/SGID files during extraction, which can lead to local privilege escalation depending on the execution environment.\n\nFor further details see: https://github.com/zip-rs/zip2/security/advisories/GHSA-vv5m-jxxh-4627",
  "id": "RUSTSEC-2026-0367",
  "keywords": [
    "privilege-escalation",
    "suid",
    "sgid"
  ],
  "patched_versions": [
    ">=9.0.0"
  ],
  "source": "debian_rustsec",
  "title": "Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation",
  "url": "https://rustsec.debian.net/advisories/RUSTSEC-2026-0367.html"
}