---
id: RUSTSEC-2026-0367
aliases:
  - GHSA-vv5m-jxxh-4627
title: ' Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation'
summary: ' Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation'
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H'
vendor: zip
product: zip
ecosystem: rust
affected:
  - 'zip >= 0.0.0-0, < 9.0.0'
patched:
  - zip 9.0.0
published: '2026-10-09'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T23:30:02.392172556Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0367'
references:
  - url: 'https://crates.io/crates/zip'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0367.html'
tags:
  - osv
  - rust
ingestedAt: '2026-10-17T11:50:15.359Z'
---

## Overview

The `zip` crate preserves privileged Unix permission bits (SUID, SGID, and sticky bits) from ZIP `external_attributes` during extraction, instead of masking them to safe permission bits. If a privileged process (for example, `root` in an installer, CI/CD pipeline, or container build) extracts an attacker-controlled ZIP archive using `ZipArchive::extract()` or the stream extraction API, files can be created as setuid-root or setgid. This behavior allows the creation of SUID/SGID files during extraction, which can lead to local privilege escalation depending on the execution environment.

For further details see: https://github.com/zip-rs/zip2/security/advisories/GHSA-vv5m-jxxh-4627

## Affected packages

- `zip >= 0.0.0-0, < 9.0.0`

## Remediation

Upgrade to a patched release:

- `zip 9.0.0`