- Reported
-
- Issued
-
- Package
-
eazip
(crates.io)
- Type
-
Vulnerability
- Categories
-
- Keywords
-
#symlink
#zip-slip
#windows
#path-escape
#extraction
- References
-
- CVSS Score
- 8.6
HIGH
- CVSS Details
-
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- Scope
- Changed
- Confidentiality Impact
- None
- Integrity Impact
- High
- Availability Impact
- None
- CVSS Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
- Patched
-
- Unaffected
-
Description
When extracting archives, eazip validates symlink entries before writing
them. The validation function validate_symlink() (src/utils/mod.rs) scans
for backslash and NUL bytes, but passes the symlink's name where the
symlink's target was intended:
memchr2(b'\\', b'\0', name.as_bytes()) // should be target.as_bytes()
As a result, symlink targets containing backslash or NUL bytes pass
validation. On Windows, backslash is a path separator, so targets such as
..\..\..\Windows\system32\evil.exe also defeat the remaining depth check,
which splits on / only. A crafted archive can therefore create symlinks
that resolve outside the extraction directory — including UNC targets such as
\\host\share\... — redirecting writes to arbitrary filesystem locations
chosen by the attacker.
Applications that extract untrusted archives with eazip on Windows targets
are affected; on Unix targets backslash is not a separator, which limits
exposure there.
The vulnerability was introduced in version 0.2.5 and fixed in 0.2.7
(a1phyr/eazip@0e4caa13),
which rejects backslash and NUL bytes in the symlink target. It was
privately reported to the maintainer on 2026-11-06 and credited in the
0.2.7 release notes.
Advisory available under CC0-1.0
license.