CVE-2026-27800

HIGH EPSS 20.7%
Published Feb 26, 20264mo ago · Modified Jun 17, 20261w ago
7.4 CVSS 3.1
High
Find Similar
Published Feb 26, 2026 4mo ago
Last Modified Jun 17, 2026 1w ago

Description

Zed, a code editor, has a Zip Slip (Path Traversal) vulnerability exists in its extension archive extraction functionality prior to version 0.224.4. The `extract_zip()` function in `crates/util/src/archive.rs` fails to validate ZIP entry filenames for path traversal sequences (e.g., `../`). This allows a malicious extension to write files outside its designated sandbox directory by downloading and extracting a crafted ZIP archive. Version 0.224.4 fixes the issue.

CVSS Details

Base Score
7.4
Exploitability
2.8
Impact
4.0
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Changed
Confidentiality None
Integrity High
Availability None

Threat Intelligence

EPSS Exploit Probability
20.7% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available

Weaknesses 1

CWE-22 Path Traversal Resource Mgmt

Affected Products 1

VendorProductVersionRange
zedzed* <0.224.4

References 1

  • github.com https://github.com/zed-industries/zed/security/advisories/GHSA-v385-xh3h-rrfr
    ExploitVendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.