ETK-2026-1925Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-1925",
  "cve_id": null,
  "display_id": "ETK-2026-1925",
  "ghsa_id": "GHSA-m665-v7pm-7grj",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "ZIP header interpretation mismatch in Rust zip",
  "summary": "Rust zip through 9.0.4 can interpret ZIP entry names inconsistently between its central-directory and streaming readers. An attacker may bypass archive checks and cause files to be written under unexpected names when an application validates an archive with one reader and extracts it with the streaming reader. This requires the application to process an attacker-controlled archive in such a mixed-reader workflow.",
  "mitigation": "Upgrade rust zip to version 9.0.5. Until all deployments are updated, avoid extracting untrusted archives with the streaming reader after validating them with a central-directory-based reader.",
  "vendor": "rust",
  "product": "rust:zip",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 9.0.4"
      ],
      "ecosystem": "rust",
      "fixed_versions": [
        "9.0.5"
      ],
      "package_name": "zip",
      "purl": "pkg:cargo/zip"
    }
  ],
  "cwes": [
    20
  ],
  "cvss_score": 10,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 17.16965785,
  "t0_at": null,
  "signals": {
    "public_poc": {
      "at": "2026-10-17T18:48:34+00:00",
      "days": -3.4716071978472223,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T06:07:40.884905+00:00",
      "url": "https://github.com/zip-rs/zip2/security/advisories/GHSA-m665-v7pm-7grj"
    },
    "trigger_signal": {
      "at": "2026-10-17T18:48:34+00:00",
      "days": -3.4716071978472223,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T06:07:40.884905+00:00",
      "url": "https://github.com/zip-rs/zip2/security/advisories/GHSA-m665-v7pm-7grj"
    }
  }
}