Bug 2537814

Summary: CVE-2026-19693 rust: extract-zip: Arbitrary file write via symlink in archive [fedora-all]
Product: [Fedora] Fedora Reporter: Ganesh <gnaik>
Component: rustAssignee: Rust SIG <rust-sig>
Status: CLOSED NOTABUG QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: high    
Version: rawhideCC: amulhern, ganesh, igor.raits, jchecahi, jistone, paumurph, rust-sig
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---Flags: paumurph: needinfo? (ganesh)
paumurph: needinfo? (gnaik)
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["f8859257-4fc4-496e-a349-a0987e4d3fd5"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2026-09-22 20:17:28 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2517432    

Description Ganesh 2026-09-22 10:52:32 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through the planted symlink and yields an arbitrary file write outside the destination directory.
Comment 1 Josh Stone 2026-09-22 20:11:38 UTC 
*** Bug 2537817 has been marked as a duplicate of this bug. ***
Comment 2 Josh Stone 2026-09-22 20:17:28 UTC 
This JavaScript library is only mentioned in unused lock files. The component sources are not present, and nothing that we build or ship will try to use it.

Furthermore, even the lock files no longer mention extract-zip in the current 1.98.1 release.
Comment 3 Paul Murphy 2026-09-22 20:41:43 UTC 
@gnaik, would you know if there is documentation you could share about how the packages are scanned for dependencies?

We get quite a few javascript related CVEs opened against Rust, if we can do anything to make those scans more accurate, it would be appreciated.