{"id":"RUSTSEC-2026-0503","aliases":[],"status":"published","title":"eazip: symlink-target validation checks the wrong argument, allowing extraction path escapes on Windows","description":"When extracting archives, `eazip` validates symlink entries before writing\nthem. The validation function `validate_symlink()` (`src/utils/mod.rs`) scans\nfor backslash and NUL bytes, but passes the symlink's *name* where the\nsymlink's *target* was intended:\n\n```rust\nmemchr2(b'\\\\', b'\\0', name.as_bytes()) // should be target.as_bytes()\n```\n\nAs a result, symlink *targets* containing backslash or NUL bytes pass\nvalidation. On Windows, backslash is a path separator, so targets such as\n`..\\..\\..\\Windows\\system32\\evil.exe` also defeat the remaining depth check,\nwhich splits on `/` only. A crafted archive can therefore create symlinks\nthat resolve outside the extraction directory — including UNC targets such as\n`\\\\host\\share\\...` — redirecting writes to arbitrary filesystem locations\nchosen by the attacker.\n\nApplications that extract untrusted archives with `eazip` on Windows targets\nare affected; on Unix targets backslash is not a separator, which limits\nexposure there.\n\nThe vulnerability was introduced in version 0.2.5 and fixed in 0.2.7\n([a1phyr/eazip@0e4caa13](https://github.com/a1phyr/eazip/commit/0e4caa13d59f5ba15aaac332f5534260c3b8fc43)),\nwhich rejects backslash and NUL bytes in the symlink target. It was\nprivately reported to the maintainer on 2026-11-06 and credited in the\n0.2.7 release notes.","severity":{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high","from":"osv"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-11-07T12:00:00Z","modified":"2026-11-12T08:00:03Z","fixes":[{"ecosystem":"crates.io","package":"eazip","fixed_in":["0.2.7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"eazip","ranges":[{"type":"SEMVER","events":[{"introduced":"0.2.5"},{"fixed":"0.2.7"}]}]}],"references":[{"url":"https://crates.io/crates/eazip","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0503.html","tags":["advisory"]},{"url":"https://github.com/a1phyr/eazip/releases/tag/v0.2.7","tags":["web"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0503","title":"eazip: symlink-target validation checks the wrong argument, allowing extraction path escapes on Windows","description":"When extracting archives, `eazip` validates symlink entries before writing\nthem. The validation function `validate_symlink()` (`src/utils/mod.rs`) scans\nfor backslash and NUL bytes, but passes the symlink's *name* where the\nsymlink's *target* was intended:\n\n```rust\nmemchr2(b'\\\\', b'\\0', name.as_bytes()) // should be target.as_bytes()\n```\n\nAs a result, symlink *targets* containing backslash or NUL bytes pass\nvalidation. On Windows, backslash is a path separator, so targets such as\n`..\\..\\..\\Windows\\system32\\evil.exe` also defeat the remaining depth check,\nwhich splits on `/` only. A crafted archive can therefore create symlinks\nthat resolve outside the extraction directory — including UNC targets such as\n`\\\\host\\share\\...` — redirecting writes to arbitrary filesystem locations\nchosen by the attacker.\n\nApplications that extract untrusted archives with `eazip` on Windows targets\nare affected; on Unix targets backslash is not a separator, which limits\nexposure there.\n\nThe vulnerability was introduced in version 0.2.5 and fixed in 0.2.7\n([a1phyr/eazip@0e4caa13](https://github.com/a1phyr/eazip/commit/0e4caa13d59f5ba15aaac332f5534260c3b8fc43)),\nwhich rejects backslash and NUL bytes in the symlink target. It was\nprivately reported to the maintainer on 2026-11-06 and credited in the\n0.2.7 release notes.","status":"published","published":"2026-11-07T12:00:00Z","modified":"2026-11-12T08:00:03.177054765Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-12T08:05:53.493073Z"}]}}