RUSTSEC-2026-0369 - Debian Rust Security Tracker

RUSTSEC-2026-0369: ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target

critical 14 affected

ZipStreamReader::extract() applies Unix permissions through extracted symlinks without validating the symlink target stays within the destination

For further details see: https://github.com/zip-rs/zip2/security/advisories/GHSA-4684-h2q9-2vcp

zip 5.1.1 czkawka-cli 12.0.2-2

zip 5.1.1 czkawka-gui 12.0.2-1

zip 5.1.1 doxx 0.1.4+dfsg-1+b1

zip 5.1.1 feluda 1.17.0-1

zip 5.1.1 grcov 0.10.7-1+b1

zip 5.1.1 icu4x-datagen 2.2.0-1+b2

affected ⚠️ librust-zip-dev 5.1.1+dfsg-1

zip 5.1.1 miniserve 0.35.0-5+b2

zip 5.1.1 ognibuild 0.2.19-2+b2

zip 5.1.1 sccache 0.17.0+ds-3+b2

zip 5.1.1 tealdeer 1.9.0-1+b2

zip 5.1.1 ty 0.0.85+ruff0.16.10+ds-1

zip 5.1.1 wasm-pack 0.15.0+ds-2+b2

zip 5.1.1 xleak 0.2.6+dfsg-1+b1