RUSTSEC-2026-0297 `unzip`: archive extraction is vulnerable to path traversal (zip-slip)
Attackers can write files outside the destination directory via malicious ZIP archives, affecting applications using the unmaintained Rust unzip library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is RUSTSEC-2026-0297?
RUSTSEC-2026-0297 is a path traversal vulnerability in unzip, published on 9 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Summary
Unzipper::unzip extracts each archive entry to a path built from the entry's
raw, attacker-controlled name without any traversal check. A ZIP archive whose
entry names contain ../ components (or an absolute path) can therefore cause
files to be written outside the destination directory chosen by the caller —
a "zip-slip" / directory-traversal arbitrary file write (CWE-22 / CWE-23 /
CWE-36).
Affected versions
All published versions are affected. unzip has only ever released 0.1.0
(published 2017-12-23) and appears unmaintained, so no fixed version is
available.
Proof of concept
A malicious archive with a single entry named ../ESCAPED.txt extracted via
Unzipper::unzip writes ESCAPED.txt one level above the destination directory.
Which versions are affected by RUSTSEC-2026-0297?
1 open source package ship an affected version, including unzip.
| Package | Affected | Fixed in |
|---|---|---|
unzip crates.io | From 0.0.0-0 | None |
How do I fix RUSTSEC-2026-0297?
No fix has been published for RUSTSEC-2026-0297 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is RUSTSEC-2026-0297 being exploited?
There is no known exploitation of RUSTSEC-2026-0297 in the wild and no public exploit code.