crates.io/zip CVE-2025-29787: high 7.3, EPSS 0.58%
Incorrect path canonicalization during Archive Extraction Leading to Arbitrary File Write
Action: Upgrade zip to 2.3.0 or later.
cargo update -p zip --precise 2.3.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.3.0 | 2.3.0 | - |
Fixed versions
| 2.3.0 |
Sources
- osv: RUSTSEC-2025-0168
- nvd: CVE-2025-29787
- https://crates.io/crates/zip
- https://rustsec.org/advisories/RUSTSEC-2025-0168.html
- https://github.com/zip-rs/zip2/commit/a2e062f37066c3b12860a32eb1cb44856cfb7afe
CVE-2025-29787 · published · modified · JSON