Collected research

Disguises Zip Past Path Traversal

@phaldrzynski and Paweł Hałdrzyński · blog.isec.pl · 5 August 2025

A schizophrenic ZIP is parsed differently by two readers in the same program. When an application lists entry names with one API and extracts with another, a crafted archive hides a traversing entry from the validator while the extractor writes it, defeating pre-extraction Zip Slip checks and giving arbitrary file write; shown in Java, Ruby, Node and an old Rust crate.

Record

Researcher

@phaldrzynski and Paweł Hałdrzyński

Published by

blog.isec.pl

Date

5 August 2025

Topic

Server

In the archive

• Collected in the 2025 research round

Tags

• path-traversal
• parser-differential
• filter-bypass
• file-upload
• java
• ruby
• rust
• nodejs
• owasp-a01-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of @phaldrzynski and Paweł Hałdrzyński, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.