In the library zip-rs, written in the Rust language and with about 10 million downloads per week, vulnerability (CVE-2026-115905) that allows you to create archives that look like harmless, but when unpacked, other files, not initially shown in the list, are extracted from them. Files may be located in the archive outside of the “Central Directory” structure, which is why when viewing a list of files one content is shown, but when unpacking via the ZipStreamReader API, other files are extracted. The issue is assigned a severity level of 10 out of 10. The vulnerability is fixed in version zip-rs 9.0.5.
The vulnerability is caused by the use of different headers when randomly accessing an archive using the ZipArchive API and when retrieving data in streaming mode using the API ZipStreamReader. The ZipArchive processor relies on the CDFH (Central Directory File Header) header, and the ZipStreamReader considers the LFH (Local File Header) header to take precedence when retrieving files, without synchronizing duplicate metadata.
The vulnerability can be used to bypass email filters, virus scanners, and other security check systems. An attacker can place a document or image in the visible part of the archive, and place an executable file with malicious code in the hidden part, which will not be detected by the antivirus, but will be saved to disk when unpacked by the user. Examples include attacks on microservices, SaaS platforms and container isolation systems, during which when unpacking harmless archives, for example, with sets of styles, text files or images, in directories with working projects, scripts and executable files can be overwritten.
Additionally, you can note vulnerability (CVE-2026-96889) in the library librsvg, developed by the GNOME project in the Rust language. The library is used in GTK and GNOME applications for rendering SVG, and is also used in the popular NPM package sharp, which has 80 million downloads per week and is used as a dependency in almost 11 thousand projects. The vulnerability allows you to organize the execution of your code when processing specially designed SVG images. Problem fixed in versions librsvg 2.56.6, 2.60.3, 2.62.4 and 2.63.1, as well as the NPM package sharp 0.35.5. Among the affected projects was the PeerTube platform (dependency updated in today’s release PeerTube 8.3.2