The vulnerability resides in the zip-rs:zip2 library, a Rust ZIP file reader/writer. In releases 7.2.0 through 9.0.0 the extraction routines validate symbolic link targets using only a lexical prefix comparison, neglecting to resolve intermediate links. An attacker who can supply a crafted ZIP file or otherwise influence extraction can construct a symlink chain where the final file path appears to remain within the intended extraction directory but actually resolves to an arbitrary location on the filesystem. This flaw enables creation or overwriting of files with the privileges of the extracting process, effectively an arbitrary write. The weakness aligns with CWE‑22 (Path Traversal), CWE‑59 (Improper Handling of Special Cases), and CWE‑61 (Improper File Handling).

The affected product is the Rust ZIP library owned by zip-rs, specifically versions 7.2.0 up to and including 9.0.0. Systems that use this library to process ZIP archives—particularly services that run extraction as an elevated user or with SeCreateSymbolicLinkPrivilege on Windows—are impacted.

With a CVSS score of 7.4 this vulnerability is classified as high severity. The EPSS score is unavailable, and it is not listed in the CISA KEV catalog, but the exploit vector is well understood: an attacker must deliver a specially crafted ZIP archive to the vulnerable process, which is a realistic scenario for many applications that accept user‑supplied ZIP files. Successful exploitation results in the attacker being able to write or overwrite arbitrary files on the host system with the privileges of the extraction process, potentially leading to privilege escalation, persistence, or data tampering.