Critical File Overwrite Vulnerability in rust-zip Package
Summary
CVE-2025-29787: zip is a zip library for rust which supports reading and writing of simple ZIP files. Affects rust-zip versions < a2e062f37066c3b12860a32eb1cb44856cfb7afe. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rust-zip package is a Rust library designed for reading and writing ZIP files. It provides a simple interface for handling ZIP archives, making it a popular choice for developers working with compressed file formats. However, certain versions of this package are vulnerable to a critical issue that allows maliciously crafted ZIP archives to overwrite arbitrary files on the file system during extraction.
Vulnerability Detail
The vulnerability identified as CVE-2025-29787 affects versions of the rust-zip crate starting from 1.3.0 and prior to 2.3.0. It arises from the archive extraction routine, which permits symbolic links earlier in the archive to be used for later files without proper validation of the final canonicalized path. This flaw can be exploited by attackers to create ZIP files that, when extracted, overwrite critical files on the system with arbitrary permissions, potentially leading to code execution.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid extracting untrusted ZIP archives until the package is updated. If extraction is necessary, consider using a different tool that does not have this vulnerability or manually inspect the contents of the archive before extraction.
Conclusion
The rust-zip package has a critical vulnerability that allows for arbitrary file overwriting when extracting ZIP archives. Users are strongly advised to update to version 2.3.0 or later to mitigate this risk. Until an update can be applied, it is crucial to avoid extracting untrusted archives.
See every vulnerability recorded for rust-zip →
FAQ
CVE-2025-29787 is a vulnerability in the rust-zip package that allows malicious ZIP files to overwrite arbitrary files on the file system during extraction.
Versions of rust-zip starting from 1.3.0 and prior to 2.3.0 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, refrain from extracting untrusted ZIP files and consider using alternative tools that do not have this vulnerability.
Exploiting this vulnerability can lead to critical files being overwritten, which may result in data loss, system instability, or unauthorized code execution.
Related vulnerabilities
Recent vulnerabilities recorded for rust-zip.
