CVE-2025-29787 zip Vulnerable to Incorrect Path Canonicalization During Archive Extraction, Leading to Arbitrary File Write
Attackers can overwrite arbitrary files via malicious ZIP archives due to improper path canonicalization, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-29787?
CVE-2025-29787 is a high-severity path traversal vulnerability in zip-rs zip2, published on 17 Mar 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
`zip` is a zip library for rust which supports reading and writing of simple ZIP files. In the archive extraction routine of affected versions of the `zip` crate starting with version 1.3.0 and prior to version 2.3.0, symbolic links earlier in the archive are allowed to be used for later files in the archive without validation of the final canonicalized path, allowing maliciously crafted archives to overwrite arbitrary files in the file system when extracted. Users who extract untrusted archive files using the following high-level API method may be affected and critical files on the system may be overwritten with arbitrary file permissions, which can potentially lead to code execution. Version 2.3.0 fixes the issue.
Which versions are affected by CVE-2025-29787?
3 open source packages ship an affected version, including zip.
| Package | Affected | Fixed in |
|---|---|---|
zip crates.io | From 1.3.0 | 2.3.0 |
zip crates.io | From 1.3.0 | 2.3.0 |
zip crates.io | From 1.3.0 | 2.3.0 |
How do I fix CVE-2025-29787?
Upgrade zip to 2.3.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-29787 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-29787 exists.
Sources
Also known as GHSA-94vh-gphv-8pm8, RUSTSEC-2025-0168, UBUNTU-CVE-2025-29787.