---
id: RUSTSEC-2025-0172
title: '`zip-extract` is unmaintained; use the `zip >= 2.4.0` crate instead'
summary: '`zip-extract` is unmaintained; use the `zip >= 2.4.0` crate instead'
severity: none
vendor: zip-extract
product: zip-extract
ecosystem: rust
affected:
  - zip-extract >= 0.0.0-0
published: '2025-07-16'
updated: '2026-08-31'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2025-0172'
references:
  - url: 'https://crates.io/crates/zip-extract'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2025-0172.html'
  - url: >-
      https://github.com/MCOfficer/zip-extract/commit/2950ec98d33b6e752b4f0976d67d89feb6f4acde
tags:
  - osv
  - rust
ingestedAt: '2026-08-31T19:30:40.137Z'
---

## Overview

The [`zip-extract`](https://crates.io/crates/zip-extract) crate has been
explicitly deprecated by its author on [Jul 16, 2025](https://github.com/MCOfficer/zip-extract/commit/2950ec98d33b6e752b4f0976d67d89feb6f4acde), and the repository
was archived on [Sep 8, 2025](https://github.com/MCOfficer/zip-extract).

The author added deprecation notices [README](https://github.com/MCOfficer/zip-extract/commit/2950ec98d33b6e752b4f0976d67d89feb6f4acde#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5R1-R8)
stating that the functionality is now available directly in the [`zip`](https://crates.io/crates/zip) crate
via [`ZipArchive::extract`](https://docs.rs/zip/8.6.0/zip/read/struct.ZipArchive.html#method.extract)
(available since zip 0.6.0) and
[`ZipArchive::extract_unwrapped_root_dir`](https://docs.rs/zip/8.6.0/zip/read/struct.ZipArchive.html#method.extract_unwrapped_root_dir)
(available since zip 2.4.0).

If you are using [`zip-extract`](https://crates.io/crates/zip-extract), switch to the
[`zip >= 2.4.0`](https://crates.io/crates/zip) crate and use the methods above instead.

## Affected packages

- `zip-extract >= 0.0.0-0`

## Remediation

Refer to the advisory for the patched release.