8 matches found
`zip-extract` is unmaintained; use the `zip >= 2.4.0` crate instead
The zip-extract crate has been explicitly deprecated by its author on Jul 16, 2025, and the repository was archived on Sep 8, 2025. The author added deprecation notices README stating that the functionality is now available directly in the zip crate via ZipArchive::extract available since zip 0.6...
zip Incorrectly Canonicalizes Paths during Archive Extraction Leading to Arbitrary File Write
Summary In the archive extraction routine of affected versions of the zip crate, symbolic links earlier in the archive are allowed to be used for later files in the archive without validation of the final canonicalized path, allowing maliciously crafted archives to overwrite arbitrary files in th...
GHSA-94VH-GPHV-8PM8 zip Incorrectly Canonicalizes Paths during Archive Extraction Leading to Arbitrary File Write
Summary In the archive extraction routine of affected versions of the zip crate, symbolic links earlier in the archive are allowed to be used for later files in the archive without validation of the final canonicalized path, allowing maliciously crafted archives to overwrite arbitrary files in th...
UBUNTU-CVE-2025-29787
zip is a zip library for rust which supports reading and writing of simple ZIP files. In the archive extraction routine of affected versions of the zip crate starting with version 1.3.0 and prior to version 2.3.0, symbolic links earlier in the archive are allowed to be used for later files in the...
RUSTSEC-2025-0168 Incorrect path canonicalization during Archive Extraction Leading to Arbitrary File Write
In the archive extraction routine of affected versions of the zip crate, symbolic links earlier in the archive are allowed to be used for later files in the archive without validation of the final canonicalized path, allowing maliciously crafted archives to overwrite arbitrary files in the file...
Incorrect path canonicalization during Archive Extraction Leading to Arbitrary File Write
In the archive extraction routine of affected versions of the zip crate, symbolic links earlier in the archive are allowed to be used for later files in the archive without validation of the final canonicalized path, allowing maliciously crafted archives to overwrite arbitrary files in the file...
PT-2025-62913
In the archive extraction routine of affected versions of the zip crate, symbolic links earlier in the archive are allowed to be used for later files in the archive without validation of the final canonicalized path, allowing maliciously crafted archives to overwrite arbitrary files in the file...