RUSTSEC-2025-0168

Incorrect path canonicalization during Archive Extraction Leading to Arbitrary File Write

Reported

March 16, 2025

Issued

August 11, 2026

Package

zip (crates.io)

Type

Vulnerability

Keywords

#file-overwrite #symlink #path-traversal

Aliases

References

https://github.com/zip-rs/zip2/security/advisories/GHSA-94vh-gphv-8pm8

CVSS Score

7.3 HIGH

CVSS Details

Attack Complexity: High
Attack Requirements: None
Attack Vector: Network
Privileges Required: Low
Availability Impact to the Subsequent System: High
Confidentiality Impact to the Subsequent System: High
Integrity Impact to the Subsequent System: High
User Interaction: None
Availability Impact to the Vulnerable System: None
Confidentiality Impact to the Vulnerable System: Low
Integrity Impact to the Vulnerable System: High

CVSS Vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:H/SI:H/SA:H

Patched

>=2.3.0

Unaffected

<1.3.0

Affected Functions

Version

zip::read::ZipArchive::extract

<2.3.0, >=1.3.0

zip::unstable::stream::ZipStreamReader::extract

<2.3.0, >=1.3.0

Description

In the archive extraction routine of affected versions of the zip crate, symbolic links earlier in the archive are allowed to be used for later files in the archive without validation of the final canonicalized path, allowing maliciously crafted archives to overwrite arbitrary files in the file system when extracted.

For more details, see the GitHub-hosted security advisory: https://github.com/zip-rs/zip2/security/advisories/GHSA-94vh-gphv-8pm8

Advisory available under CC-BY-4.0 license. Source: https://github.com/zip-rs/zip2/security/advisories/GHSA-94vh-gphv-8pm8