zip Vulnerable to Incorrect Path Canonicalization During Archive Extraction, Leading to Arbitrary File Write
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
`zip` is a zip library for rust which supports reading and writing of simple ZIP files. In the archive extraction routine of affected versions of the `zip` crate starting with version 1.3.0 and prior to version 2.3.0, symbolic links earlier in the archive are allowed to be used for later files in the archive without validation of the final canonicalized path, allowing maliciously crafted archives to overwrite arbitrary files in the file system when extracted. Users who extract untrusted archive files using the following high-level API method may be affected and critical files on the system may be overwritten with arbitrary file permissions, which can potentially lead to code execution. Version 2.3.0 fixes the issue.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| zip-rs | zip2 | 1.3.0 to before 2.3.0 | 2.3.0 | Patch available | CNA |
| — | zip (crates.io) | 1.3.0 to before 2.3.0 | 2.3.0 | Patch available | GHSA-94vh-gphv-8pm8 |
- zip2 Vendorzip-rs Affected 1.3.0 to before 2.3.0 Fixed in 2.3.0 Patch available CNA
- zip (crates.io) Vendor— Affected 1.3.0 to before 2.3.0 Fixed in 2.3.0 Patch available GHSA-94vh-gphv-8pm8
Remediation
- Fix · CNA zip2 (zip-rs) Fixed in 2.3.0
- Fix · GHSA-94vh-gphv-8pm8 zip (crates.io) Fixed in 2.3.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-29787
- 2026-10-03 Alias added: GHSA-94vh-gphv-8pm8
References
Other 5
- https://github.com/zip-rs/zip2/security/advisories/GHSA-94vh-gphv-8pm8
- https://github.com/zip-rs/zip2/commit/a2e062f37066c3b12860a32eb1cb44856cfb7afe
- https://gist.github.com/eternal-flame-AD/bf71ef4f6828e741eb12ce7fd47b7b85
- https://github.com/zip-rs/zip2/releases/tag/v2.3.0
- https://github.com/zip-rs/zip2
More zip-rs vulnerabilities
- TI-2026-80483 Parser differential in Rust zip library allows file overwrite CVSS 4.0CRITICAL 10.0
- TI-2026-80489 Denial of service in zip crate from attacker-controlled ZIP64 size CVSS 3.1HIGH 7.5
- TI-2026-80488 Authentication bypass in zip Rust crate lets modified AES entries pass CVSS 3.1MEDIUM 6.5
- TI-2026-80491 Excessive allocation in zip Rust crate aborts extraction of symlinks CVSS 3.1HIGH 7.5
- TI-2026-80490 Arbitrary file write outside extraction directory in Rust zip crate CVSS 3.1HIGH 7.4
Sources
- CVE-2025-29787 · CVE Program
- CVE-2025-29787 · NVD
- FIRST EPSS
- GHSA-94vh-gphv-8pm8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences