CVE-2026-27800

Zed has Zip Slip Path Traversal in Extension Archive Extraction

State: Published
Severity: 7.4 High
Published: Feb 25, 2026
Updated: Feb 26, 2026
Reserved: Feb 24, 2026

Description

Zed, a code editor, has a Zip Slip (Path Traversal) vulnerability exists in its extension archive extraction functionality prior to version 0.224.4. The `extract_zip()` function in `crates/util/src/archive.rs` fails to validate ZIP entry filenames for path traversal sequences (e.g., `../`). This allows a malicious extension to write files outside its designated sandbox directory by downloading and extracting a crafted ZIP archive. Version 0.224.4 fixes the issue.

Scores

CVSS	Score	Vector	Source
3.1	7.4 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N	GitHub_M

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

Product	Versions
zedzed-industries	< 0.224.4Affected

References

https://github.com/zed-industries/zed/security/advisories/GHSA-v385-xh3h-rrfr

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.