RUSTSEC-2026-0297
`unzip`: archive extraction is vulnerable to path traversal (zip-slip)
Summary
Unzipper::unzip extracts each archive entry to a path built from the entry's
raw, attacker-controlled name without any traversal check. A ZIP archive whose
entry names contain ../ components (or an absolute path) can therefore cause
files to be written outside the destination directory chosen by the caller —
a "zip-slip" / directory-traversal arbitrary file write (CWE-22 / CWE-23 /
CWE-36).
Affected versions
All published versions are affected. unzip has only ever released 0.1.0
(published 2017-12-23) and appears unmaintained, so no fixed version is
available.
Proof of concept
A malicious archive with a single entry named ../ESCAPED.txt extracted via
Unzipper::unzip writes ESCAPED.txt one level above the destination directory.
What each source reports
OSV No score
`unzip`: archive extraction is vulnerable to path traversal (zip-slip)
Summary
Unzipper::unzip extracts each archive entry to a path built from the entry's
raw, attacker-controlled name without any traversal check. A ZIP archive whose
entry names contain ../ components (or an absolute path) can therefore cause
files to be written outside the destination directory chosen by the caller —
a "zip-slip" / directory-traversal arbitrary file write (CWE-22 / CWE-23 /
CWE-36).
Affected versions
All published versions are affected. unzip has only ever released 0.1.0
(published 2017-12-23) and appears unmaintained, so no fixed version is
available.
Proof of concept
A malicious archive with a single entry named ../ESCAPED.txt extracted via
Unzipper::unzip writes ESCAPED.txt one level above the destination directory.
- Record
RUSTSEC-2026-0297- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
unzipcrates.io |
0.0.0-0 and later | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
RUSTSEC-2026-0297 is a vulnerability with no CVSS score yet in unzip, published September 9, 2026. No source lists public exploit code. No source names a fixed version.