{"id":"ghsa-ghsa-m665-v7pm-7grj","seq":2056942,"kind":"advisory","title":"zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE","url":"https://github.com/advisories/GHSA-m665-v7pm-7grj","permalink":"https://vulnpulse.app/items/ghsa-ghsa-m665-v7pm-7grj","summary":"影響: rust:zip <= 9.0.4 → 9.0.5\nA critical architectural parser differential exists in the zip crate ( (&mut self, file: &mut ZipFile ) -> ZipResult { file.safe_prepare_path(&self.outpath, &mut outpath, None:: bool)>)?; let mut outfile = fs::File::create(&outpath)?; io::copy(file, &mut outfile)?; Ok(()) } - src/write.rs:L1552: The crate explicitly exposes shallow_copy_file, an API that constructs dual-header desynchronizations by adding a new CDFH entry with an alias name pointing to an existing file without updating the orig…","severity":"critical","techs":["rust"],"cves":["CVE-2026-115905"],"tags":["GHSA-m665-v7pm-7grj","zip"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T21:09:50.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}