---
id: CVE-2025-29787
aliases:
  - RUSTSEC-2025-0168
  - GHSA-94vh-gphv-8pm8
title: >-
  Incorrect path canonicalization during Archive Extraction Leading to Arbitrary
  File Write
summary: >-
  Incorrect path canonicalization during Archive Extraction Leading to Arbitrary
  File Write
severity: high
vendor: zip
product: zip
ecosystem: rust
affected:
  - 'zip >= 1.3.0, < 2.3.0'
patched:
  - zip 2.3.0
published: '2025-03-16'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T18:00:13.042644063Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2025-0168'
references:
  - url: 'https://crates.io/crates/zip'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2025-0168.html'
  - url: >-
      https://github.com/zip-rs/zip2/commit/a2e062f37066c3b12860a32eb1cb44856cfb7afe
  - url: 'https://github.com/zip-rs/zip2/security/advisories/GHSA-94vh-gphv-8pm8'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-29787'
  - url: 'https://gist.github.com/eternal-flame-AD/bf71ef4f6828e741eb12ce7fd47b7b85'
  - url: 'https://github.com/zip-rs/zip2'
  - url: 'https://github.com/zip-rs/zip2/releases/tag/v2.3.0'
tags:
  - osv
  - rust
epss: 0.00564
epssPercentile: 0.46708
ingestedAt: '2026-08-11T19:17:10.122Z'
---

## Overview

In the archive extraction routine of affected versions of the zip crate, symbolic links earlier in the archive are allowed to be used for later files in the archive without validation of the final canonicalized path, allowing maliciously crafted archives to overwrite arbitrary files in the file system when extracted.

For more details, see the GitHub-hosted security advisory: <https://github.com/zip-rs/zip2/security/advisories/GHSA-94vh-gphv-8pm8>

## Affected packages

- `zip >= 1.3.0, < 2.3.0`

## Remediation

Upgrade to a patched release:

- `zip 2.3.0`