## zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE

- 種別: advisory
- 重大度: critical
- 関連技術: rust
- CVE: CVE-2026-115905
- 公開日時: 2026-10-28T21:09:50.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-m665-v7pm-7grj)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-m665-v7pm-7grj

影響: rust:zip <= 9.0.4 → 9.0.5
A critical architectural parser differential exists in the zip crate ( (&mut self, file: &mut ZipFile ) -> ZipResult { file.safe_prepare_path(&self.outpath, &mut outpath, None:: bool)>)?; let mut outfile = fs::File::create(&outpath)?; io::copy(file, &mut outfile)?; Ok(()) } - src/write.rs:L1552: The crate explicitly exposes shallow_copy_file, an API that constructs dual-header desynchronizations by adding a new CDFH entry with an alias name pointing to an existing file without updating the orig…