Yes, there can be.
The main risk with unpacking zips is that it overwrites an executable or config file. For example, if the zip contains a
.bashrc and you extract it in your home directory then it could overwrite yours and the next time you log in, the attacker's code will run.
For a worst-case scenario, consider a webserver that open zip archives, maybe from user uploads, because
unzip will run the the same privilege as the webserver process, likely being able to overwrite executables or config files belonging to the webserver. Hopefully the admin isn't sloppily running the webserver process as root.
There was a recent public vulnerability called Zip Slip which made this even worse: some unzipping tools were allowing filenames to contain
.. within a zip archive, which makes this attack even more dangerous because a zip containing the following file will overwrite
/bin/ls no matter where in your filesystem you're trying to extract it to:
(or any other executable that the extracting process has permission to overwrite)
Proper zip extracting hygiene:
- If possible, check the authenticity of the zip archive before you extract it (you got it from somewhere trustworthy, checksum, signature, etc).
- If possible, avoid running
unzip as root, that way system files can't be overwritten.
- If possible, unzip into a new clean directory so that, barring chroot exploits like Zip Slip above, there is nothing in that folder to overwrite.