Is this vulnerability remotely exploitable?

It can be exploitable remotely if an attacker can cause Zed to download and install a crafted extension ZIP from a remote source, such as a malicious extension repository entry or a compromised distribution channel. The vulnerability is triggered during ZIP extraction, not simply by network access alone.

What level of access does an attacker need?

The attacker needs the ability to provide or influence the ZIP archive processed by Zed's extension extraction logic. This may involve publishing a malicious extension, compromising an existing extension, or otherwise directing Zed to an attacker-controlled archive. They do not necessarily need local shell access to the victim machine.

What is the safest general fix pattern?

The most robust fix is to treat ZIP entry names as untrusted, canonicalize the combined base-plus-entry path, and then verify that the result is still inside the target extraction directory before writing. Any entries that fail this containment check, or that contain suspicious constructs like `..` or absolute paths, should be rejected.

Severity:

HIGH RISK

(7.4)

Zip Slip Path Traversal (CWE-22) in Zed Extension Archive Extraction

CVE-2026-27800

Published:

Feb 25, 2026

Status:

Received

Summary

Affected Context

Exploit Preconditions

Why This Happens

Potential Impact

General Mitigation Guidance

How Teams Detect Issues Like This

Frequently Asked Questions

Source

NDV

Recent Vulnerabilities

CWE-78

HIGH RISK

HIGH

(7.5)

OS Command Injection via Unsanitized Filenames (CWE-78) in Manyfold Render Generation

Remote Code Execution

February 25, 2026

CWE-22;CWE-248

HIGH RISK

HIGH

(7.2)

Path Traversal & Unhandled Panic (CWE-22, CWE-248) in Vikunja Backup Restore

Arbitrary File Overwrite and Application Crash with Data Loss

February 25, 2026

Vulnerability Type

Category:

Path Traversal / Zip Slip

CWE:

CWE-22

Impact:

Arbitrary File Write Outside Sandbox

Severity:

HIGH RISK

(7.4)

CVSS Version:

3.1

Vulnerability Type

Category:

Path Traversal / Zip Slip

CWE:

CWE-22

Impact:

Arbitrary File Write Outside Sandbox

Severity:

HIGH RISK

(7.4)

CVSS Version:

3.1

Catch This CVE While Code Is Being Written

Detect vulnerable code directly in pull requests, so CVEs are fixed before merge.

Get Started

Ship clean & secure code faster

START 14 DAYS FREE TRIAL

BOOK A DEMO

Made with Love in San Francisco

355 Bryant St. San Francisco, CA 94107, USA

Ask AI for summary of CodeAnt

Made with Love in San Francisco

355 Bryant St. San Francisco, CA 94107, USA

Ask AI for summary of CodeAnt

Made with Love in San Francisco

355 Bryant St. San Francisco, CA 94107, USA

Ask AI for summary of CodeAnt

Zip Slip Path Traversal (CWE-22) in Zed Extension Archive Extraction

Summary

Affected Context

Exploit Preconditions

Why This Happens

Potential Impact

General Mitigation Guidance

How Teams Detect Issues Like This

Frequently Asked Questions

Source

Recent Vulnerabilities

HIGH RISK

HIGH

(7.5)

OS Command Injection via Unsanitized Filenames (CWE-78) in Manyfold Render Generation

HIGH RISK

HIGH

(7.2)

Path Traversal & Unhandled Panic (CWE-22, CWE-248) in Vikunja Backup Restore

Vulnerability Type

Vulnerability Type

Vulnerability Type

Catch This CVE While Code Is Being Written

Ship clean & secure code faster

Product

Pricing

Company

Legal

Developers

Compare

Product

Pricing

Company

Legal

Developers

Compare

Product

Pricing

Company

Legal

Developers

Compare