CVE-2025-29787

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

`zip` is a zip library for rust which supports reading and writing of simple ZIP files. In the archive extraction routine of affected versions of the `zip` crate starting with version 1.3.0 and prior to version 2.3.0, symbolic links earlier in the archive are allowed to be used for later files in the archive without validation of the final canonicalized path, allowing maliciously crafted archives to overwrite arbitrary files in the file system when extracted. Users who extract untrusted archive files using the following high-level API method may be affected and critical files on the system may be overwritten with arbitrary file permissions, which can potentially lead to code execution. Version 2.3.0 fixes the issue.

Metrics

CVSS 4.0 7.3/10

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-22 CWE-61 CWE-180

Affected software

No affected versions have been published.

Timeline

Published: Mar 17, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-297886.5The Syliud PayPal Plugin is the Sylius Core Team’s plugin for the PayPal Commerce Platform. A vulnerability in versions prior to 1.6.1, 1.7.CVE-2025-297897.5OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 7.3.0 are vulnera CVE-2025-29795.4A vulnerability classified as problematic has been found in WCMS 11. This affects an unknown part of the file /index.php?anonymous/setregist CVE-2025-297905.4Contao is an Open Source CMS. Users can upload SVG files with malicious code, which is then executed in the back end and/or front end. This CVE-2025-297917.8Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-297927.3Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.CVE-2025-297937.2Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2025-297948.8Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2025-297957.8Improper link resolution before file access ('link following') in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate p CVE-2025-297964.7User interface (ui) misrepresentation of critical information in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing CVE-2025-29803.5A vulnerability classified as problematic was found in Legrand SMS PowerView 1.x. This vulnerability affects unknown code. The manipulation CVE-2025-298007.8Improper privilege management in Microsoft AutoUpdate (MAU) allows an authorized attacker to elevate privileges locally.