RUSTSEC-2026-0427

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0427

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0427.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0427

Published

2026-10-29T12:00:00Z

Modified

2026-10-30T11:15:02Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

`sn-releases`: `extract_release_archive` writes archive entries without a path-traversal check (zip-slip)

Details

SafeReleaseRepoActions::extract_release_archive builds each output path from the raw archive entry name and writes to it with no traversal check, so a malicious release archive can create directories and write files outside the destination directory, a "zip-slip" / path traversal (CWE-22 / CWE-23).

In src/lib.rs (extract_release_archive, zip branch):

let mut file = archive.by_index(i)?;
let out_path = dest_dir_path.join(file.name());   // file.name() is the raw entry name
if file.name().ends_with('/') {
    std::fs::create_dir_all(&out_path)?;          // no `..` check
} else {
    let mut outfile = std::fs::File::create(&out_path)?;   // writes outside dest
    std::io::copy(&mut file, &mut outfile)?;
}

The crate is unmaintained (latest release 0.3.1, 2024-10-22) and no fixed version is available.

Database specific

{
    "license":  "CC0-1.0"
}

References

Affected packages

crates.io / sn-releases

Package

Name: sn-releases; View open source insights on deps.dev
Purl: pkg:cargo/sn-releases

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Ecosystem specific

{
    "affected_functions":  null,
    "affects":  {
        "arch":  [],
        "functions":  [
            "sn_releases::SafeReleaseRepoActions::extract_release_archive"
        ],
        "os":  []
    }
}