CVE-2025-29787High▾ TwilightIncorrect path canonicalization during Archive Extraction Leading to Arbitrary File Write
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 11.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.5%
0.5% → 0.6%
Last analysed / modified upstream
In the archive extraction routine of affected versions of the zip crate, symbolic links earlier in the archive are allowed to be used for later files in the archive without validation of the final canonicalized path, allowing maliciously crafted archives to overwrite arbitrary files in the file system when extracted.
For more details, see the GitHub-hosted security advisory: https://github.com/zip-rs/zip2/security/advisories/GHSA-94vh-gphv-8pm8
zip >= 1.3.0, < 2.3.0Upgrade to a patched release:
zip 2.3.0Connected by shared product, vendor, weakness, or advisory.
RUSTSEC-2026-0369Critical· 9.1ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target
RUSTSEC-2026-0367High· 7.3Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation
RUSTSEC-2026-0368Nonezip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination directory
CVE-2018-13410Critical· 9.8Info-ZIP Zip 3.0, when the -T and -TT command-line options are used, allows attackers to cause a denial of service (invalid free and application crash) or possibly have unspecified other impact because of an off-by-one error