CVE-2025-29787
2 advisories.
crates.io/zip CVE-2025-29787: high
zip Incorrectly Canonicalizes Paths during Archive Extraction Leading to Arbitrary File Write
Action: Upgrade zip to 2.3.0 or later.
cargo update -p zip --precise 2.3.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.3.0 | 2.3.0 | - |
Fixed versions
| 2.3.0 |
Sources
- osv: GHSA-94vh-gphv-8pm8
- https://github.com/zip-rs/zip2/security/advisories/GHSA-94vh-gphv-8pm8
- https://nvd.nist.gov/vuln/detail/CVE-2025-29787
- https://github.com/zip-rs/zip2/commit/a2e062f37066c3b12860a32eb1cb44856cfb7afe
- https://gist.github.com/eternal-flame-AD/bf71ef4f6828e741eb12ce7fd47b7b85
- https://github.com/zip-rs/zip2
- https://github.com/zip-rs/zip2/releases/tag/v2.3.0
CVE-2025-29787 · published · modified · JSON
crates.io/zip CVE-2025-29787: unknown
Incorrect path canonicalization during Archive Extraction Leading to Arbitrary File Write
Action: Upgrade zip to 2.3.0 or later.
cargo update -p zip --precise 2.3.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.3.0 | 2.3.0 | - |
Fixed versions
| 2.3.0 |
Sources
- osv: RUSTSEC-2025-0168
- https://crates.io/crates/zip
- https://rustsec.org/advisories/RUSTSEC-2025-0168.html
- https://github.com/zip-rs/zip2/commit/a2e062f37066c3b12860a32eb1cb44856cfb7afe
CVE-2025-29787 · published · modified · JSON