VYPR
← All advisories
High severity7.4NVD Advisory· Published Feb 26, 2026· Updated Jun 17, 2026

CVE-2026-27800

CVE-2026-27800

Description

Zed, a code editor, has a Zip Slip (Path Traversal) vulnerability exists in its extension archive extraction functionality prior to version 0.224.4. The extract_zip() function in crates/util/src/archive.rs fails to validate ZIP entry filenames for path traversal sequences (e.g., ../). This allows a malicious extension to write files outside its designated sandbox directory by downloading and extracting a crafted ZIP archive. Version 0.224.4 fixes the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Zed Industries/Zedv52 versions
    < 0.224.4+ 1 more
    • (no CPE)range: < 0.224.4
    • (no CPE)range: <0.224.4
  • Zed/Zed
    cpe:2.3:a:zed:zed:*:*:*:*:*:*:*:*
    Range: <0.224.4

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.