{"action":"Upgrade zip to 2.3.0 or later.","affected":[{"fixed":"2.3.0","introduced":"1.3.0"}],"component":"zip","cve_ids":["CVE-2025-29787"],"ecosystem":"crates.io","epss":0.00585,"exploited":false,"fixed_versions":["2.3.0"],"ghsa_id":"GHSA-94vh-gphv-8pm8","id":"tcs_01M5KEW48Z4WTB2P9Y1Z6A4YB7","modified_at":"2026-09-10T03:50:23.090058245Z","published_at":"2025-03-17T21:26:32Z","references":["https://osv.dev/vulnerability/GHSA-94vh-gphv-8pm8","https://github.com/zip-rs/zip2/security/advisories/GHSA-94vh-gphv-8pm8","https://nvd.nist.gov/vuln/detail/CVE-2025-29787","https://github.com/zip-rs/zip2/commit/a2e062f37066c3b12860a32eb1cb44856cfb7afe","https://gist.github.com/eternal-flame-AD/bf71ef4f6828e741eb12ce7fd47b7b85","https://github.com/zip-rs/zip2","https://github.com/zip-rs/zip2/releases/tag/v2.3.0"],"severity":{"label":"high","score":7.3},"sources":[{"source":"osv","source_id":"GHSA-94vh-gphv-8pm8","url":"https://osv.dev/vulnerability/GHSA-94vh-gphv-8pm8"},{"source":"nvd","source_id":"CVE-2025-29787","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-29787"}],"summary":"zip Incorrectly Canonicalizes Paths during Archive Extraction Leading to Arbitrary File Write"}