Threats affecting pkg:cargo/github/zip-rs/zip2

CVE-2026-115905 is a critical vulnerability in the zip-rs zip2 Rust library affecting versions prior to 9.0.5. The flaw arises from inconsistent handling of filenames between the Central Directory File Header and the Local File Header during ZIP archive extraction. This discrepancy allows a crafted archive to appear safe when inspected via the central directory but to cause a streaming extractor to write files to attacker-chosen paths, potentially overwriting important files used by downstream services. The issue is fixed in version 9.0.5.