Vulnerability RUSTSEC-2025-0168
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
1 year ago
March 16, 2025 at 12:00 PM UTC
Incorrect path canonicalization during Archive Extraction Leading to Arbitrary File Write
1.3.0 - 2.2.3
1.3.0 - 2.2.3
Summary
Incorrect path canonicalization during Archive Extraction Leading to Arbitrary File Write
Details
In the archive extraction routine of affected versions of the zip crate, symbolic links earlier in the archive are allowed to be used for later files in the archive without validation of the final canonicalized path, allowing maliciously crafted archives to overwrite arbitrary files in the file system when extracted.
For more details, see the GitHub-hosted security advisory: https://github.com/zip-rs/zip2/security/advisories/GHSA-94vh-gphv-8pm8
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Impacted packages
Timeline
Published
1 year ago
March 16, 2025 at 12:00 PM UTC
Fixed (2.3.0)
1 year ago
March 16, 2025 at 05:31 PM UTC
Last Modified
1 hour ago
October 12, 2026 at 06:00 PM UTC