RUSTSEC-2026-0367: Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation
high 14 affectedThe zip crate preserves privileged Unix permission bits (SUID, SGID, and sticky bits) from ZIP external_attributes during extraction, instead of masking them to safe permission bits. If a privileged process (for example, root in an installer, CI/CD pipeline, or container build) extracts an attacker-controlled ZIP archive using ZipArchive::extract() or the stream extraction API, files can be created as setuid-root or setgid. This behavior allows the creation of SUID/SGID files during extraction, which can lead to local privilege escalation depending on the execution environment.
For further details see: https://github.com/zip-rs/zip2/security/advisories/GHSA-vv5m-jxxh-4627
Affected Packages
zip 5.1.1
czkawka-cli 12.0.2-2
zip 5.1.1
czkawka-gui 12.0.2-1
zip 5.1.1
doxx 0.1.4+dfsg-1+b1
zip 5.1.1
feluda 1.17.0-1
zip 5.1.1
grcov 0.10.7-1+b1
zip 5.1.1
icu4x-datagen 2.2.0-1+b2
affected
⚠️
librust-zip-dev 5.1.1+dfsg-1
zip 5.1.1
miniserve 0.35.0-5+b2
zip 5.1.1
ognibuild 0.2.19-2+b2
zip 5.1.1
sccache 0.17.0+ds-3+b2
zip 5.1.1
tealdeer 1.9.0-1+b2
zip 5.1.1
ty 0.0.85+ruff0.16.10+ds-1
zip 5.1.1
wasm-pack 0.15.0+ds-2+b2
zip 5.1.1
xleak 0.2.6+dfsg-1+b1