zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE

Summary A critical architectural parser differential exists in the zip crate ( (&mut self, file: &mut ZipFile ) -> ZipResult { file.safe_prepare_path(&self.outpath, &mut outpath, None:: bool)>)?; let mut outfile = fs::File::create(&outpath)?; io::copy(file, &mut outfile)?; Ok(())

Source: GitHub Advisory Database