CVE-2026-115908

The zip library for Rust (versions 7.2.0 through 9.0.0 ) is vulnerable to an arbitrary file write due to a regression in how symbolic links are validated. Specifically, ZipArchive::extract and ZipArchive::extract_unwrapped_root_dir use lexical prefix comparisons instead of resolving each intermed...

CVE-2026-115908 zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (The defense against CVE-2025-29787 was broken in v7.2.0)

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 7.2.0 until 9.0.0, ZipArchive::extract and ZipArchive::extractunwrappedrootdir use safepreparepath in src/read/zipfile.rs and simplifiedcomponents in src/path.rs to validate symbolic link targets with a lexical...

CVE-2026-115905 zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE

zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in...

CVE-2026-115905 zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE

zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in...

CVE-2026-115905

The zip library for Rust (through version 9.0.4 ) is vulnerable to a critical parser differential and security control bypass caused by dual-header inconsistencies, often referred to as Zip Cloaking . The root cause resides in src/read/stream.rs, where ZipArchive treats Central Directory File Hea...

CVE-2026-115905 zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE

zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in...

CVE-2026-112343

Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to evade per-path permission overrides by exploiting case-insensitive filesystem path resolution and 8.3 short names. Attackers can address a protected directory using alternate...

CVE-2026-112344 Syncplify Server! 6.0.0 < 8.8.0 Symbolic Link Jail Escape

Syncplify Server! 6.0.0 before 8.8.0 contains a path traversal vulnerability that allows attackers with a symbolic link placed inside a user's home folder to access files outside the virtual filesystem root because confinement is enforced only against the requested path and not the on-disk...

CVE-2026-112344 Syncplify Server! 6.0.0 < 8.8.0 Symbolic Link Jail Escape

Syncplify Server! 6.0.0 before 8.8.0 contains a path traversal vulnerability that allows attackers with a symbolic link placed inside a user's home folder to access files outside the virtual filesystem root because confinement is enforced only against the requested path and not the on-disk...

CVE-2026-112343 Syncplify Server! < 8.8.0 Permission Override Bypass via Path Casing

Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to evade per-path permission overrides by exploiting case-insensitive filesystem path resolution and 8.3 short names. Attackers can address a protected directory using alternate...

EUVD-2026-109966

Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to evade per-path permission overrides by exploiting case-insensitive filesystem path resolution and 8.3 short names. Attackers can address a protected directory using alternate...

CVE-2026-112343 Syncplify Server! < 8.8.0 Permission Override Bypass via Path Casing

Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to evade per-path permission overrides by exploiting case-insensitive filesystem path resolution and 8.3 short names. Attackers can address a protected directory using alternate...

Security Bulletin: Multiple Security Vulnerabilities in Apache Struts affect IBM Sterling File Gateway (CVE-2026-73634, CVE-2026-73635)

Summary IBM Sterling File Gateway has addressed these security vulnerabilities Vulnerability Details CVEID:CVE-2026-73634 DESCRIPTION: Uncontrolled resource consumption vulnerability in Apache Struts. An application that exposes an endpoint collecting Content Security Policy violation reports rea...

Security Bulletin: Multiple Security Vulnerabilities in Apache Struts affect IBM Sterling B2B Integrator (CVE-2026-73634, CVE-2026-73635)

Summary IBM Sterling B2B Integrator has addressed these security vulnerabilities Vulnerability Details CVEID:CVE-2026-73634 DESCRIPTION: Uncontrolled resource consumption vulnerability in Apache Struts. An application that exposes an endpoint collecting Content Security Policy violation reports...

CVE-2026-90885

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. XQueryBuilder in camel-saxon, which evaluates expressions for the xquery language and the xquery component,...

CVE-2026-93328

Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases googleapis/mcp-toolbox versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local...

CVE-2026-90885 Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was Resolved

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. XQueryBuilder in camel-saxon, which evaluates expressions for the xquery language and the xquery component,...

CVE-2026-90885

The Apache Camel Saxon component (specifically XQueryBuilder ) is vulnerable to an Improper Restriction of XML External Entity Reference (XXE) vulnerability. The root cause is that the component's default Saxon Configuration only enforces whitespace stripping, leaving the XML parser in a state wh...

CVE-2026-90885 Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was Resolved

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. XQueryBuilder in camel-saxon, which evaluates expressions for the xquery language and the xquery component,...

CVE-2026-90885 Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was Resolved

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. XQueryBuilder in camel-saxon, which evaluates expressions for the xquery language and the xquery component,...