rustsec-2026-0369

debian_rustsec
Description

`ZipStreamReader::extract()` applies Unix permissions through extracted symlinks without validating the symlink target stays within the destination For further details see: https://github.com/zip-rs/zip2/security/advisories/GHSA-4684-h2q9-2vcp

Timeline
Published
unknown
Last Modified
unknown
CVSS Details

CVSS details not available.

Affected Products

No product information available.

References

No references available.

Linked Vulnerabilities

No linked vulnerabilities found.

{
  "aliases": [
    "GHSA-4684-h2q9-2vcp"
  ],
  "categories": [
    "privilege-escalation"
  ],
  "crate": "zip",
  "cves": [],
  "cvss": 0.0,
  "database_specific": {
    "severity": "critical"
  },
  "date": "2026-10-10",
  "deb_packages": [
    {
      "crate_name": "czkawka-cli",
      "deb_name": "czkawka-cli",
      "version": "12.0.2-2"
    },
    {
      "crate_name": "czkawka-gui",
      "deb_name": "czkawka-gui",
      "version": "12.0.2-1"
    },
    {
      "crate_name": "icu4x-datagen",
      "deb_name": "icu4x-datagen",
      "version": "2.2.0-1+b2"
    },
    {
      "crate_name": "ognibuild",
      "deb_name": "ognibuild",
      "version": "0.2.21-1"
    },
    {
      "crate_name": "xleak",
      "deb_name": "xleak",
      "version": "0.2.6+dfsg-1+b1"
    }
  ],
  "description": "`ZipStreamReader::extract()` applies Unix permissions through extracted symlinks without validating the symlink target stays within the destination\n\nFor further details see: https://github.com/zip-rs/zip2/security/advisories/GHSA-4684-h2q9-2vcp",
  "id": "RUSTSEC-2026-0369",
  "keywords": [
    "privilege-escalation",
    "symlink",
    "permissions"
  ],
  "patched_versions": [
    ">=9.0.0"
  ],
  "source": "debian_rustsec",
  "title": "ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target",
  "url": "https://rustsec.debian.net/advisories/RUSTSEC-2026-0369.html"
}
View JSON API Download JSON