Stream: git-wasmtime

Topic: wasmtime / issue #14792 RUSTSEC-2026-0368: zip: `ZipArchi...

view this post on Zulip Wasmtime GitHub notifications bot (Oct 17 2026 at 00:13):

github-actions[bot] opened issue #14792:

zip: ZipArchive::extract creates symbolic links whose attacker-controlled targets are outside the destination directory

Details
Package zip
Version 0.6.6
Date 2026-10-09
Patched versions >=9.0.0

In zip 9.0.0-pre2, ZipArchive::extract creates a symbolic link from an archive entry after validating only the output entry path. The link target bytes are passed directly to the platform symlink API, so a malicious archive can create an entry inside the destination that resolves to an attacker-chosen path outside it. This behavior was verified on macOS and Linux. On either platform, a subsequent application read or write through that extracted entry accesses the external target with the extracting process's permissions.

For further details see: https://github.com/zip-rs/zip2/security/advisories/GHSA-4v9h-p7m9-rh26

See advisory page for additional details.

view this post on Zulip Wasmtime GitHub notifications bot (Oct 17 2026 at 02:22):

alexcrichton commented on issue #14792:

Closing in favor of https://github.com/bytecodealliance/wasmtime/issues/14790, also about this dep

view this post on Zulip Wasmtime GitHub notifications bot (Oct 17 2026 at 02:22):

alexcrichton closed issue #14792:

zip: ZipArchive::extract creates symbolic links whose attacker-controlled targets are outside the destination directory

Details
Package zip
Version 0.6.6
Date 2026-10-09
Patched versions >=9.0.0

In zip 9.0.0-pre2, ZipArchive::extract creates a symbolic link from an archive entry after validating only the output entry path. The link target bytes are passed directly to the platform symlink API, so a malicious archive can create an entry inside the destination that resolves to an attacker-chosen path outside it. This behavior was verified on macOS and Linux. On either platform, a subsequent application read or write through that extracted entry accesses the external target with the extracting process's permissions.

For further details see: https://github.com/zip-rs/zip2/security/advisories/GHSA-4v9h-p7m9-rh26

See advisory page for additional details.

Last updated: Oct 31 2026 at 23:03 UTC