Critical Zip Cloaking Vulnerability Fixed in Rust Zip Crate Version 9.0.5
A critical parser differential flaw known as Zip Cloaking in the Rust zip crate allows for arbitrary file overwrites, requiring users to update to version 9.0.5 immediately.
CVE-2026-115905 is a critical vulnerability in the Rust zip crate affecting versions through 9.0.4.
The parser differential flaw, known as Zip Cloaking, occurs because ZipArchive uses the Central Directory File Header for filenames while ZipStreamReader in src/read/stream.rs extracts files using the Local File Header without validating them against the central directory. This lets a crafted archive appear harmless during central directory inspection while a streaming extractor writes different content to an attacker-chosen path, potentially leading to arbitrary file overwrite and remote code execution that can overwrite files used by a downstream service.
Published on October 26, 2026, the CVE entry credits GitHub as the source. Because the aggregator lists no CVSS metrics, it shows a score of 0.0, lists no affected products, and marks the flaw as not remotely exploitable. Practical risk is highest where one component validates archives and another extracts them.
You should update the zip dependency to version 9.0.5, which fixes the issue. Additionally, you should check your archive-handling code for filename consistency between the two headers.