rustsec-2026-0297

osv_rustsec
Description

### Summary `Unzipper::unzip` extracts each archive entry to a path built from the entry's **raw, attacker-controlled name** without any traversal check. A ZIP archive whose entry names contain `../` components (or an absolute path) can therefore cause files to be written **outside** the destination directory chosen by the caller — a "zip-slip" / directory-traversal arbitrary file write (CWE-22 / CWE-23 / CWE-36). ### Affected versions All published versions are affected. `unzip` has only ever released `0.1.0` (published 2017-12-23) and appears unmaintained, so **no fixed version is available**. ### Proof of concept A malicious archive with a single entry named `../ESCAPED.txt` extracted via `Unzipper::unzip` writes `ESCAPED.txt` one level above the destination directory.

Timeline
Published
unknown
Last Modified
unknown
CVSS Details

CVSS details not available.

Affected Products

No product information available.

References
Linked Vulnerabilities

No linked vulnerabilities found.

{
  "affected": [
    {
      "database_specific": {
        "categories": [
          "code-execution"
        ],
        "cvss": null,
        "informational": null,
        "source": "https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0297.json"
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [
            "unzip::Unzipper::unzip"
          ],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "unzip",
        "purl": "pkg:cargo/unzip"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-0"
            }
          ],
          "type": "SEMVER"
        }
      ]
    }
  ],
  "database_specific": {
    "license": "CC0-1.0"
  },
  "details": "### Summary\n\n`Unzipper::unzip` extracts each archive entry to a path built from the entry's\n**raw, attacker-controlled name** without any traversal check. A ZIP archive whose\nentry names contain `../` components (or an absolute path) can therefore cause\nfiles to be written **outside** the destination directory chosen by the caller —\na \"zip-slip\" / directory-traversal arbitrary file write (CWE-22 / CWE-23 /\nCWE-36).\n\n### Affected versions\n\nAll published versions are affected. `unzip` has only ever released `0.1.0`\n(published 2017-12-23) and appears unmaintained, so **no fixed version is\navailable**.\n\n### Proof of concept\n\nA malicious archive with a single entry named `../ESCAPED.txt` extracted via\n`Unzipper::unzip` writes `ESCAPED.txt` one level above the destination directory.",
  "id": "RUSTSEC-2026-0297",
  "modified": "2026-09-21T15:30:02.907499769Z",
  "published": "2026-09-09T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/unzip"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2026-0297.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/unzip"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "`unzip`: archive extraction is vulnerable to path traversal (zip-slip)"
}
View JSON API Download JSON