---
id: RUSTSEC-2026-0368
aliases:
  - GHSA-4v9h-p7m9-rh26
title: >-
  zip: `ZipArchive::extract` creates symbolic links whose attacker-controlled
  targets are outside the destination directory
summary: >-
  zip: `ZipArchive::extract` creates symbolic links whose attacker-controlled
  targets are outside the destination directory
severity: none
vendor: zip
product: zip
ecosystem: rust
affected:
  - 'zip >= 0.0.0-0, < 9.0.0'
patched:
  - zip 9.0.0
published: '2026-10-09'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T23:30:02.383750571Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0368'
references:
  - url: 'https://crates.io/crates/zip'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0368.html'
tags:
  - osv
  - rust
ingestedAt: '2026-10-17T11:50:15.359Z'
---

## Overview

In `zip` 9.0.0-pre2, `ZipArchive::extract` creates a symbolic link from an archive entry after validating only the output entry path. The link target bytes are passed directly to the platform symlink API, so a malicious archive can create an entry inside the destination that resolves to an attacker-chosen path outside it. This behavior was verified on macOS and Linux. On either platform, a subsequent application read or write through that extracted entry accesses the external target with the extracting process's permissions.

For further details see: https://github.com/zip-rs/zip2/security/advisories/GHSA-4v9h-p7m9-rh26

## Affected packages

- `zip >= 0.0.0-0, < 9.0.0`

## Remediation

Upgrade to a patched release:

- `zip 9.0.0`