High, CVSS 8.6crates.ioPublished
eazip: symlink-target validation checks the wrong argument, allowing extraction path escapes on Windows
- Affected
- crates.io eazip >= 0.2.5, < 0.2.7
- Fixed in
- 0.2.7· Vendor fix available
- Issue
- When extracting archives, `eazip` validates symlink entries before writing them. The validation function `validate_symlink()` (`src/utils/mod.rs`) scans for backslash and NUL bytes, but passes the symlink's *name* where the symlink's *target* was intended: ```rust memchr2(b'\\', b'\0', name.as_bytes()) // should be target.as_bytes() ``` As a result, symlink *targets* containing backslash or NUL bytes pass validation. On Windows, backslash is a path separator, so targets such as `..\..\..\Windows\system32\evil.exe` also defeat the remaining depth check, which splits on `/` only. A crafted archive can therefore create symlinks that resolve outside the extraction directory — including UNC targets such as `\\host\share\...` — redirecting writes to arbitrary filesystem locations chosen by the attacker. Applications that extract untrusted archives with `eazip` on Windows targets are affected; on Unix targets backslash is not a separator, which limits exposure there. The vulnerability was…
Recommended action: Upgrade to 0.2.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.