RUSTSEC-2026-0367: Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation

What to do

1. See which version you have: cargo tree -i zip (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p zip. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example zip = "9.0.0") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

The zip crate preserves privileged Unix permission bits (SUID, SGID, and sticky bits) from ZIP external_attributes during extraction, instead of masking them to safe permission bits. If a privileged process (for example, root in an installer, CI/CD pipeline, or container build) extracts an attacker-controlled ZIP archive using ZipArchive::extract() or the stream extraction API, files can be created as setuid-root or setgid. This behavior allows the creation of SUID/SGID files during extraction, which can lead to local privilege escalation depending on the execution environment.

For further details see: https://github.com/zip-rs/zip2/security/advisories/GHSA-vv5m-jxxh-4627

References

• Package: crates.io/crates/zip
• Advisory: rustsec.org/advisories/RUSTSEC-2026-0367.html

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for zip

• VulnerabilityRUSTSEC-2025-0168 · 2025-03-16Incorrect path canonicalization during Archive Extraction Leading to Arbitrary File Write
• VulnerabilityRUSTSEC-2026-0368 · 2026-10-09zip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination directory
• Vulnerability CriticalRUSTSEC-2026-0369 · 2026-10-10ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target

Full security history of zip