RUSTSEC-2025-0168

See a problem?
Please try reporting it to the source first.
Source
https://rustsec.org/advisories/RUSTSEC-2025-0168
Import Source
https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2025-0168.json
JSON Data
https://api.osv.dev/v1/vulns/RUSTSEC-2025-0168
Aliases
Published
2025-03-16T12:00:00Z
Modified
2026-08-11T10:30:03.278476437Z
Severity
  • 7.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:H/SI:H/SA:H CVSS Calculator
Summary
Incorrect path canonicalization during Archive Extraction Leading to Arbitrary File Write
Details

In the archive extraction routine of affected versions of the zip crate, symbolic links earlier in the archive are allowed to be used for later files in the archive without validation of the final canonicalized path, allowing maliciously crafted archives to overwrite arbitrary files in the file system when extracted.

For more details, see the GitHub-hosted security advisory: https://github.com/zip-rs/zip2/security/advisories/GHSA-94vh-gphv-8pm8

Database specific 
{
    "license": "CC-BY-4.0"
}
References

Affected packages

crates.io / zip

Package

Name
zip
View open source insights on deps.dev
Purl
pkg:cargo/zip

Affected ranges

Type
SEMVER
Events
Introduced
1.3.0
Fixed
2.3.0

Ecosystem specific 

{
    "affects": {
        "arch": [],
        "os": [],
        "functions": [
            "zip::read::ZipArchive::extract",
            "zip::unstable::stream::ZipStreamReader::extract"
        ]
    },
    "affected_functions": null
}

Database specific

informational 
null
source 
"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2025-0168.json"
cvss 
"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:H/SI:H/SA:H"
categories 
[]