RUSTSEC-2026-0297None▾ Sunlit`unzip`: archive extraction is vulnerable to path traversal (zip-slip)
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
Unzipper::unzip extracts each archive entry to a path built from the entry's
raw, attacker-controlled name without any traversal check. A ZIP archive whose
entry names contain ../ components (or an absolute path) can therefore cause
files to be written outside the destination directory chosen by the caller —
a "zip-slip" / directory-traversal arbitrary file write (CWE-22 / CWE-23 /
CWE-36).
All published versions are affected. unzip has only ever released 0.1.0
(published 2017-12-23) and appears unmaintained, so no fixed version is
available.
A malicious archive with a single entry named ../ESCAPED.txt extracted via
Unzipper::unzip writes ESCAPED.txt one level above the destination directory.
unzip >= 0.0.0-0Refer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.