RUSTSEC-2026-0503
eazip: symlink-target validation checks the wrong argument, allowing extraction path escapes on Windows
RUSTSEC-2026-0503 is a high vulnerability (CVSS 8.6) in eazip, published November 7, 2026. No source lists public exploit code. Fixed in eazip 0.2.7.
- Severity
- 8.6 HighCVSS 3.1, OSV
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.2.7eazip
Description
When extracting archives, eazip validates symlink entries before writing
them. The validation function validate_symlink() (src/utils/mod.rs) scans
for backslash and NUL bytes, but passes the symlink's name where the
symlink's target was intended:
memchr2(b'\\', b'\0', name.as_bytes()) // should be target.as_bytes()
As a result, symlink targets containing backslash or NUL bytes pass
validation. On Windows, backslash is a path separator, so targets such as
..\..\..\Windows\system32\evil.exe also defeat the remaining depth check,
which splits on / only. A crafted archive can therefore create symlinks
that resolve outside the extraction directory — including UNC targets such as
\\host\share\... — redirecting writes to arbitrary filesystem locations
chosen by the attacker.
Applications that extract untrusted archives with eazip on Windows targets
are affected; on Unix targets backslash is not a separator, which limits
exposure there.
The vulnerability was introduced in version 0.2.5 and fixed in 0.2.7 (a1phyr/eazip@0e4caa13), which rejects backslash and NUL bytes in the symlink target. It was privately reported to the maintainer on 2026-11-06 and credited in the 0.2.7 release notes.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
eazipcrates.io | 0.2.5 up to 0.2.7 | 0.2.7 |
What each source reports
OSV Score used
eazip: symlink-target validation checks the wrong argument, allowing extraction path escapes on Windows
When extracting archives, eazip validates symlink entries before writing
them. The validation function validate_symlink() (src/utils/mod.rs) scans
for backslash and NUL bytes, but passes the symlink's name where the
symlink's target was intended:
memchr2(b'\\', b'\0', name.as_bytes()) // should be target.as_bytes()
As a result, symlink targets containing backslash or NUL bytes pass
validation. On Windows, backslash is a path separator, so targets such as
..\..\..\Windows\system32\evil.exe also defeat the remaining depth check,
which splits on / only. A crafted archive can therefore create symlinks
that resolve outside the extraction directory — including UNC targets such as
\\host\share\... — redirecting writes to arbitrary filesystem locations
chosen by the attacker.
Applications that extract untrusted archives with eazip on Windows targets
are affected; on Unix targets backslash is not a separator, which limits
exposure there.
The vulnerability was introduced in version 0.2.5 and fixed in 0.2.7 (a1phyr/eazip@0e4caa13), which rejects backslash and NUL bytes in the symlink target. It was privately reported to the maintainer on 2026-11-06 and credited in the 0.2.7 release notes.
- Record
RUSTSEC-2026-0503- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N - Updated
- 2026-11-12
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.