RUSTSEC-2025-0168: Incorrect path canonicalization during Archive Extraction Leading to Arbitrary File Write

What to do

1. See which version you have: cargo tree -i zip (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p zip. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example zip = "2.3.0") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

In the archive extraction routine of affected versions of the zip crate, symbolic links earlier in the archive are allowed to be used for later files in the archive without validation of the final canonicalized path, allowing maliciously crafted archives to overwrite arbitrary files in the file system when extracted.

For more details, see the GitHub-hosted security advisory: <https://github.com/zip-rs/zip2/security/advisories/GHSA-94vh-gphv-8pm8>

References

• Package: crates.io/crates/zip
• Advisory: rustsec.org/advisories/RUSTSEC-2025-0168.html
• Web: github.com/zip-rs/zip2/commit/a2e062f37066c3b12860a32eb1cb44856cfb7afe

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for zip

• Vulnerability HighRUSTSEC-2026-0367 · 2026-10-09 Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation
• VulnerabilityRUSTSEC-2026-0368 · 2026-10-09zip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination directory
• Vulnerability CriticalRUSTSEC-2026-0369 · 2026-10-10ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target

Full security history of zip