zip vulnerabilities (crates.io)
9 vulnerabilities.
-
zipcrates.io zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (The defense against CVE-2025-29787 was broken in v7.2.0) 7.4 High -
zipcrates.io zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size 7.5 High -
zipcrates.io zip: AES Entry HMAC Authentication Bypass on Premature EOF 6.5 Medium -
zipcrates.io zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE 10.0 Critical -
zipcrates.io zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction 7.5 High -
zipcrates.io ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target 9.1 Critical -
zipcrates.io Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation 7.3 High -
zipcrates.io zip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination directory No score -
zipcrates.io zip Vulnerable to Incorrect Path Canonicalization During Archive Extraction, Leading to Arbitrary File Write 7.3 High