RUSTSEC-2026-0427

Dashboard / Vulnerabilities / RUSTSEC-2026-0427

RUSTSEC-2026-0427

Summary: `sn-releases`: `extract_release_archive` writes archive entries without a path-traversal check (zip-slip)

Details: `SafeReleaseRepoActions::extract_release_archive` builds each output path from the **raw archive entry name** and writes to it with no traversal check, so a malicious release archive can create directories and write files **outside** the destination directory, a "zip-slip" / path traversal (CWE-22 / CWE-23). In `src/lib.rs` (`extract_release_archive`, zip branch): ```rust let mut file = archive.by_index(i)?; let out_path = dest_dir_path.join(file.name()); // file.name() is the raw entry name if file.name().ends_with('/') { std::fs::create_dir_all(&out_path)?; // no `..` check } else { let mut outfile = std::fs::File::create(&out_path)?; // writes outside dest std::io::copy(&mut file, &mut outfile)?; } ``` The crate is unmaintained (latest release 0.3.1, 2024-10-22) and no fixed version is available.

References: https://crates.io/crates/sn-releases, https://rustsec.org/advisories/RUSTSEC-2026-0427.html, https://github.com/maidsafe/sn-releases