.nav-burger { display: none !important; } @media (max-width: 1180px) { /* Match Tailwind's base layer: its important [hidden] reset otherwise wins. */ @layer base { .nav-overlay[hidden] { display: flex !important; } } .nav-overlay[hidden] { position: static; padding: 2rem 1rem; } }

zip 2.3.0 vulnerabilities

9 advisories known · zip@2.3.0 · 6 affect this release · Dependencies not checked

SEVERITYADVISORYPUBLISHED

Affects 2.3.0

SEVERITYADVISORYPUBLISHED

Criticalzip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCEGHSA-m665-v7pm-7grjCVE-2026-115905Affected <9.0.5Fixed in 9.0.5OSV source ↗7 days ago

CriticalZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the targetRUSTSEC-2026-0369GHSA-4684-h2q9-2vcpAffected >=0.0.0-0 <9.0.0Fixed in 9.0.0OSV source ↗26 days ago

Highzip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During ExtractionGHSA-q7v9-x93c-xqv3CVE-2026-115909RUSTSEC-2026-0429Affected >=0.0.0-0 <9.0.0Fixed in 9.0.0OSV source ↗14 days ago

High Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege EscalationRUSTSEC-2026-0367GHSA-vv5m-jxxh-4627Affected >=0.0.0-0 <9.0.0Fixed in 9.0.0OSV source ↗27 days ago

Mediumzip: AES Entry HMAC Authentication Bypass on Premature EOFGHSA-8hxf-qr8p-62x4CVE-2026-115906Affected >=0.6.0 <9.0.0Fixed in 9.0.0OSV source ↗7 days ago

Unknownzip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination directoryRUSTSEC-2026-0368GHSA-4v9h-p7m9-rh26Affected >=0.0.0-0 <9.0.0Fixed in 9.0.0OSV source ↗27 days ago

Does not affect 2.3.0

SEVERITYADVISORYPUBLISHED

Highzip Incorrectly Canonicalizes Paths during Archive Extraction Leading to Arbitrary File WriteGHSA-94vh-gphv-8pm8CVE-2025-29787RUSTSEC-2025-0168Affected >=1.3.0 <2.3.0Fixed in 2.3.0OSV source ↗2 years ago

Highzip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed sizeGHSA-9hj8-73fh-9963CVE-2026-115907Affected >=5.1.0 <9.0.0Fixed in 9.0.0OSV source ↗7 days ago

Highzip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. GHSA-hjqx-j4rw-g7xvCVE-2026-115908Affected >=7.2.0 <9.0.0Fixed in 9.0.0OSV source ↗7 days ago