What is Zip Cloaking? A file that scans clean and extracts dirty

What exactly is the problem?

In the ZIP format, every file has two names: one in a local header before its data, and one in a central directory at the end of the archive. The Rust zip crate reads them with two readers that never talk to each other.

The random-access reader ZipArchive treats the central directory as authoritative and ignores the local header name. The streaming reader ZipStreamReader extracts files in order and writes each one under the name in its local header, without ever comparing it to the directory. Advisory GHSA-m665-v7pm-7grj calls this gap Zip Cloaking and classes it as an interpretation conflict, CWE-436.

How does the attack get through?

The attacker builds an archive whose directory says doc_report.pdf and whose local header says cron_worker.sh, so the gateway passes it and the server writes the script.

Security gateways (antivirus scanners, upload firewalls) inspect the archive with a directory reader, see a clean PDF, and approve it. The backend ingestion service then extracts the same archive with a streaming reader and writes the malicious content over a file that already exists on disk. If that file runs on a schedule, the attacker has remote code execution, and the original file is gone, so the service dies with it.

The advisory ships a full working example that shows the chain end to end, and the official record scores the flaw 10.0 on CVSS 4.0. The official CVE record is CVE-2026-115905.

Who needs to pay attention?

Any system that extracts archives coming from outside, above all when scanning and extraction are two separate steps in your setup.

The advisory names automated ingestion services, microservices and SaaS platforms that accept compressed files from users, setups where the scanning gateway reads the central directory and then hands extraction to a streaming reader, and container workloads where overwriting a config file or a script opens a container escape and a full outage.

What should you do now?

Update the crate to 9.0.5, and review where your system trusts archive file names.

• Search your project for the zip crate at 9.0.4 or older, above all the ZipStreamReader streaming reader.

• If you scan before you extract, make the scan and the extraction read the archive the same way, or compare the names between the two readers before writing.

• Library stories that break inside the supply chain have shown up here before, like the LiteLLM compromise and the Node.js security updates.

And if your platform accepts files from users and you want a proper security check of the upload and extraction path, Muhassan is built for that.