crates.io/zip CVE-2025-29787: high 7.3, EPSS 0.58%

zip Incorrectly Canonicalizes Paths during Archive Extraction Leading to Arbitrary File Write

Action: Upgrade zip to 2.3.0 or later.

cargo update -p zip --precise 2.3.0

Affected

Fixed versions

Sources

• osv: GHSA-94vh-gphv-8pm8
• nvd: CVE-2025-29787
• https://github.com/zip-rs/zip2/security/advisories/GHSA-94vh-gphv-8pm8
• https://github.com/zip-rs/zip2/commit/a2e062f37066c3b12860a32eb1cb44856cfb7afe
• https://gist.github.com/eternal-flame-AD/bf71ef4f6828e741eb12ce7fd47b7b85
• https://github.com/zip-rs/zip2
• https://github.com/zip-rs/zip2/releases/tag/v2.3.0

CVE-2025-29787 · published 2025-03-17T21:26:32Z · modified 2026-09-10T03:50:23.090058245Z · JSON