What is the CVE-2026-115905 vulnerability in the Rust zip library?

The security flaw cataloged as CVE-2026-115905 affects the Rust zip library, a component designed for reading and writing simple ZIP archives details of the critical vulnerability CVE-2026-110447 in Collabora Online inside Nextcloud. With a CVSS score of 10.0, this issue represents a severe risk for systems implementing this library in their data pipelines.

The problem lies in the way compressed file headers are processed. Up to version 9.0.4, the ZipArchive component treated filenames from the Central Directory File Header as authoritative, whereas ZipStreamReader performed extractions using filenames from the Local File Header without reconciling the metadata duplication present in the src/read/stream.rs file.

How is this metadata discrepancy exploited?

An attacker can craft a malicious ZIP archive that appears completely benign to any component tasked solely with inspecting the archive's central directory.

However, when the archive is processed by a streaming extractor, it can write a path and content chosen by the attacker. This could lead to the overwriting of critical files used by a downstream service, compromising the overall integrity of the system.

Who is affected and what is the official solution?

To resolve this severe input validation problem and parsing conflict, the maintainers have published a security update that corrects the header handling flaw.

Development teams are strongly advised to review their current dependencies and apply the corresponding patch as soon as possible to mitigate any exploitation attempts in production environments CVE-2026-115905 (CVSS 10.0).

  1. Locate the Cargo.toml file at the root of your Rust project.
  2. Update the zip library dependency by specifying the corrected version using the cargo update command or by modifying the package line.
  3. Verify that the version installed in the Cargo.lock file is at least 9.0.5 by consulting the official Technical Reference repository.
  4. Run your application's automated test suite to verify that compilation and reading of compressed files operate normally.