CVE-2025-29787 Details
Description
`zip` is a zip library for rust which supports reading and writing of simple ZIP files. In the archive extraction routine of affected versions of the `zip` crate starting with version 1.3.0 and prior to version 2.3.0, symbolic links earlier in the archive are allowed to be used for later files in the archive without validation of the final canonicalized path, allowing maliciously crafted archives to overwrite arbitrary files in the file system when extracted. Users who extract untrusted archive files using the following high-level API method may be affected and critical files on the system may be overwritten with arbitrary file permissions, which can potentially lead to code execution. Version 2.3.0 fixes the issue.
A vulnerability exists in the zip library for Rust, specifically in versions 1.3.0 through 2.2.2, that allows symbolic links in ZIP archives to overwrite arbitrary files on the filesystem during extraction. This issue arises because the extraction process does not properly validate the final path of symbolic links, enabling crafted archives to exploit this oversight. Users who extract untrusted ZIP files using the 'zip::read::ZipArchive::extract' or 'zip::unstable::stream::ZipStreamReader::extract' methods may inadvertently overwrite critical files with arbitrary permissions, potentially leading to unauthorized code execution.
Users can upgrade to 'zip' version 2.3.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Mar 17, 2025CISA-ADP
Assessed Mar 17, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/eternal-flame-AD/bf71ef4f6828e741eb12ce7fd47b7b85 | [email protected] | Exploit |
| https://github.com/zip-rs/zip2/commit/a2e062f37066c3b12860a32eb1cb44856cfb7afe | [email protected] | Source CodeVendor |
| https://github.com/zip-rs/zip2/releases/tag/v2.3.0 | [email protected] | Release NotesVendor |
| https://github.com/zip-rs/zip2/security/advisories/GHSA-94vh-gphv-8pm8 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-180 | Incorrect Behavior Order: Validate Before Canonicalize | [email protected] |
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| CWE-61 | UNIX Symbolic Link (Symlink) Following | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| zip | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 17, 2025 | New CVE Received | [email protected] |