CVE-2026-115905

A flaw was found in zip2. A remote attacker can exploit this vulnerability to achieve arbitrary code execution by supplying a specially crafted archive file. This issue occurs because the streaming extractor reads filenames from local file headers without reconciling them against the central directory index. As a result, a malicious archive can bypass security inspection controls by displaying benign filenames to scanners while overwriting critical system files during extraction.

Red Hat has rated this vulnerability as Critical because remote unauthenticated attackers can bypass file inspection controls and overwrite arbitrary system files, potentially achieving arbitrary code execution without requiring user interaction. In automated ingestion pipelines or services handling user-supplied archives, discrepancies between how headers are processed allow malicious files to masquerade under harmless names during gateway validation while extracting dangerous payloads to target directories. The overall impact depends on whether affected applications process untrusted inputs using sequential extraction routines and run with sufficient system privileges to overwrite sensitive operational files.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.