Zip Library Vulnerability in Rust Affects File System Security

CVE-2025-29787

What is CVE-2025-29787?

The zip library for Rust, which facilitates reading and writing ZIP files, contains a vulnerability in its archive extraction routine. This issue allows symbolic links present earlier in an archive to be misused for extracting later files without validating the final canonicalized path. As a result, maliciously crafted archives could overwrite arbitrary files within the file system during extraction, compromising critical files and potentially enabling code execution. The vulnerability affects versions from 1.3.0 up to but not including 2.3.0, with version 2.3.0 implementing the necessary fixes to ensure secure handling of symbolic links.

References