Zip-rs Zip2 vulnerabilities
- zip-rs zip2 zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (The defense against CVE-2025-29787 was broken in v7.2.0) 7.4 High
- zip-rs zip2 zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size 7.5 High
- zip-rs zip2 zip: AES Entry HMAC Authentication Bypass on Premature EOF 6.5 Medium
- zip-rs zip2 zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE 10.0 Critical
- zip-rs zip2 zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction 7.5 High
- zip-rs zip2 zip Vulnerable to Incorrect Path Canonicalization During Archive Extraction, Leading to Arbitrary File Write 7.3 High