CVE-2025-29787: zip-rs zip2 Path Traversal
Vulnerability summary
CVE-2025-29787 is a high (CVSS 7.3) Path Traversal vulnerability in zip-rs zip2. EPSS estimates a 0.56% chance of exploitation in the next 30 days, higher than 45.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 6Timeline
- 17-03-2025PublishedVulnerability first disclosed.
- 19-03-2025Last modifiedVulnerability information updated.
Description
`zip` is a zip library for rust which supports reading and writing of simple ZIP files. In the archive extraction routine of affected versions of the `zip` crate starting with version 1.3.0 and prior to version 2.3.0, symbolic links earlier in the archive are allowed to be used for later files in the archive without validation of the final canonicalized path, allowing maliciously crafted archives to overwrite arbitrary files in the file system when extracted. Users who extract untrusted archive files using the following high-level API method may be affected and critical files on the system may be overwritten with arbitrary file permissions, which can potentially lead to code execution. Version 2.3.0 fixes the issue.
CVSS metrics
6 scores · 6 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.3HighCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:H/SI:H/SA:H
- OSV · WolfiEcosystem advisory · calculated7.3HighCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:H/SI:H/SA:H
- OSV · ChainguardEcosystem advisory · calculated7.3HighCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:H/SI:H/SA:H
- OSV · Crates.ioEcosystem advisory · calculated7.3HighCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:H/SI:H/SA:H
- NVDNIST7.3HighCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.56%
Chance of exploitation in the next 30 days
Percentile
46%
Versus all other CVEs
30-day change
0.00 pp
From 0.56% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- CWE-61UNIX Symbolic Link (Symlink) FollowingThe product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
- CWE-180Incorrect Behavior Order: Validate Before CanonicalizeThe product validates input before it is canonicalized, which prevents the product from detecting data that becomes invalid after the canonicalization step.
Affected systems
Chainguard8 products
- deno< 2.5.6-r0
- fnm< 1.38.1-r3
- geckodriver< 0.36.0-r1
- nushell< 0.102.0-r2
- nushell-plugins< 0.102.0-r2
Wolfi7 products
- deno< 2.5.6-r0
- geckodriver< 0.36.0-r1
- nushell< 0.102.0-r2
- nushell-plugins< 0.102.0-r2
- pixi< 0.43.0-r0
Crates.Io1 product
- zip≥ 1.3.0, < 2.3.0
Ubuntu1 product
- rust-zipAll versions (No fix recorded)
Zip-rs1 product
- zip2≥ 1.3.0, < 2.3.0
5 vendors · 18 products
References
11 links
- github.com/zip-rs/zip2PACKAGE
- crates.io/crates/zipPACKAGE