A newly discovered vulnerability in popular ZIP file parsing tools has left security researchers scrambling to adapt. zipdump.py, a tool used for analyzing and extracting metadata from ZIP files, has been found to be vulnerable to encoding issues that can lead to incorrect display of filenames.
The issue affects users who work with ZIP files containing non-ASCII characters, such as Simplified Chinese text. When these files are analyzed using zipdump.py, the tool relies on the Python modules zipfile or pyzipper to parse the metadata correctly. However, if the file is corrupt or malformed, or if the encoding used for the metadata is unknown, the tool will display the filename as a byte string rather than a readable string.
This can lead to confusion and mistakes when analyzing ZIP files, particularly in cases where the filenames contain special characters. For example, if a ZIP file contains a virus signature file with a name like “example.vir”, which is encoded in UTF-8, zipdump.py will display it as a hexadecimal value rather than a readable string.
To address this issue, the developer of zipdump.py, Didier Stevens, has added a new option called –metadata_encoding. This option allows users to specify the encoding used for the metadata, such as UTF-8 or Latin, when analyzing ZIP files with the -f option. By specifying the correct encoding, users can ensure that filenames are displayed correctly and avoid confusion.
The fix also includes a feature that decodes flag bits into readable text. Flag 0x0800 indicates that the metadata is encoded in UTF-8, allowing users to determine the correct encoding to use. However, it’s worth noting that using –metadata_encoding with other codecs can lead to incorrect decoding of filenames, as seen in the example where specifying Latin encoding results in incorrect display.
The update also highlights the importance of understanding ZIP file specifications and metadata encoding. The ZIP specification states that metadata is either encoded in ASCII (CP437) or UTF-8. By checking the flag bits, users can determine which encoding to use when analyzing ZIP files with non-ASCII characters.
For security professionals working with ZIP files, this update serves as a reminder to be mindful of metadata encoding and to verify the correct encoding before analysis. While zipdump.py is not a widely used tool in the industry, this vulnerability highlights the importance of regularly updating tools and scripts to prevent similar issues from arising. By being proactive about updating tools and understanding the underlying file formats, security professionals can avoid potential pitfalls and ensure accurate analysis of ZIP files.
Source: SANS ISC — 2026-07-31