How to Unzip a Zip File on a Linux Server Safely

Updated 7 November 2026 · Standard formula, shown below

This guide walks you through extracting a ZIP archive on a Linux server without clobbering existing files, mishandling permissions, or falling for path-traversal tricks. You’ll learn the safest commands, what to check before unzipping, and how to recover if something goes wrong.

What You’ll Need

SSH access to the Linux server (command line).
The unzip utility installed (most distros include it; if not, install it via your package manager, e.g., sudo apt install unzip on Debian/Ubuntu or sudo yum install unzip on RHEL/CentOS).
Basic familiarity with navigating directories (cd, ls).
The path to the ZIP file you want to extract.

Step-by-Step

Inspect the archive before extracting.
Run unzip -l archive.zip to list the contents. This shows you the file names, sizes, and whether there are any suspicious paths (e.g., ../../etc/passwd). Look for anything that seems out of place.
Check for existing files that might be overwritten.
Use unzip -l archive.zip | awk '{print $4}' to get the file paths, then check if any of those already exist in the target directory with ls. If they do, decide whether you want to overwrite them or extract to a fresh directory.
Create a dedicated extraction directory.
Run mkdir -p /path/to/extract and then cd /path/to/extract. This isolates the new files and prevents accidental overwrites of unrelated files.
Extract with safe options.
Use unzip -o -d /path/to/extract /path/to/archive.zip. The -o overwrites existing files without prompting (safer for scripts), and -d specifies the target directory. If you want to avoid overwriting anything, use -n instead (never overwrite).
Preserve permissions and timestamps.
Add the -o flag (already there) and also consider -X to restore Unix file attributes if the archive was created on a Unix system. For most cases, the default is fine, but if you need exact permissions, use unzip -X -o -d ....
Verify the extraction.
After extraction, run ls -la /path/to/extract and spot-check a few files. Also run unzip -t archive.zip beforehand to test the archive integrity—this checks for CRC errors.
Clean up if needed.
If you extracted to a temporary directory and moved files, remove the temp dir with rm -rf /path/to/temp once you’re sure everything is correct.

Common Mistakes

Extracting in place without checking contents. This can overwrite config files or source code you didn’t intend to replace.
Ignoring path traversal entries. A malicious ZIP could contain ../../etc/cron.d/evil and overwrite system files if you extract as root. Always inspect the list first.
Using unzip without -d and extracting into the current directory accidentally. This litters your working directory with files.
Forgetting to test the archive. A corrupted ZIP might extract partially, leaving you with broken files.
Running as root when not necessary. If the files don’t need root ownership, extract as a regular user to limit damage.

Tips

Always extract to a new, empty directory first, then move files where they need to go. This gives you a chance to review.
Use unzip -Z (or zipinfo) to get more detailed info about the archive, including compression method and file attributes.
If you’re dealing with a ZIP from an untrusted source, consider using unzip -j to strip directory paths (flatten everything into one directory) to avoid path traversal, but be aware it may lose structure.
For large archives, use nohup unzip ... & or a terminal multiplexer to avoid interruption if your SSH session drops.
Set a umask before extracting if you want to control default permissions: umask 022 for world-readable, or umask 077 for private files.

Troubleshooting

“unzip: command not found”
Install unzip using your package manager: sudo apt install unzip (Debian/Ubuntu), sudo yum install unzip (RHEL/CentOS), or sudo dnf install unzip (Fedora).

“End-of-central-directory signature not found”
This usually means the file is not a valid ZIP or it’s corrupted. Try re-downloading it, or check if it’s actually a different format (e.g., a RAR or 7z file). Use file archive.zip to see what it really is.

“Permission denied” when extracting
You don’t have write permission to the target directory. Use sudo only if you’re sure it’s safe, or choose a directory you own.

“No such file or directory” when using -d
Create the directory first with mkdir -p. The -d option doesn’t create intermediate directories by default.

Files extracted but with wrong permissions
If the archive was created on Windows, permissions might be off. Run chmod -R u+rwX,go+rX on the extracted directory to set sensible defaults.

Archive extracts partially then fails
Run unzip -t archive.zip to see which files are corrupt. If a specific file is bad, you might still be able to extract the rest with unzip -o -d ... archive.zip -x badfile to exclude it.

Frequently Asked Questions

Q: Is it safe to unzip as root?
A: It’s safer to unzip as a regular user. If you must use root, inspect the archive first for path traversal entries and consider using -j to flatten paths.

Q: How do I unzip a ZIP file with a password?
A: Use unzip -P 'password' archive.zip. Note that the password may be visible in the process list; a more secure method is to use 7z x archive.zip which prompts for the password.

Q: Can I unzip multiple ZIP files at once?
A: Yes, with a loop: for f in *.zip; do unzip -o -d /target "$f"; done. This extracts each into the same target directory.

Q: What does the -o flag do?
A: It overwrites existing files without prompting. Use -n to never overwrite, and -f to freshen (only overwrite if the archive version is newer).

Q: How do I see the contents of a ZIP without extracting?
A: Run unzip -l archive.zip. This lists all files with sizes and dates.

Q: What if the ZIP contains symlinks?
A: By default, unzip extracts symlinks as symlinks on Unix systems. If you want to avoid symlink attacks, use unzip -K to keep the symlinks but be cautious, or use unzip -j to flatten.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.