RUSTSEC-2026-0503

When extracting archives, eazip validates symlink entries before writing them. The validation function validate_symlink() (src/utils/mod.rs) scans for backslash and NUL bytes, but passes the symlink's name where the symlink's target was intended:

memchr2(b'\\', b'\0', name.as_bytes()) // should be target.as_bytes()

As a result, symlink targets containing backslash or NUL bytes pass validation. On Windows, backslash is a path separator, so targets such as ..\..\..\Windows\system32\evil.exe also defeat the remaining depth check, which splits on / only. A crafted archive can therefore create symlinks that resolve outside the extraction directory — including UNC targets such as \\host\share\... — redirecting writes to arbitrary filesystem locations chosen by the attacker.

Applications that extract untrusted archives with eazip on Windows targets are affected; on Unix targets backslash is not a separator, which limits exposure there.

The vulnerability was introduced in version 0.2.5 and fixed in 0.2.7 (a1phyr/eazip@0e4caa13), which rejects backslash and NUL bytes in the symlink target. It was privately reported to the maintainer on 2026-11-06 and credited in the 0.2.7 release notes.