RUSTSEC-2026-0427: `sn-releases`: `extract_release_archive` writes archive entries without a path-traversal check (zip-slip)
SafeReleaseRepoActions::extractreleasearchive builds each output path from the raw archive entry name and writes to it with no traversal check, so a malicious release archive can create directories and write files outside the destination directory, a "zip-slip" / path traversal (CWE-22 / CWE-23).
In src/lib.rs (extractreleasearchive, zip branch):
rust let mut file = archive.byindex(i)?; let outpath = destdirpath.join(file.name()); // file.name() is the raw entry name if file.name().endswith('/') { std::fs::createdirall(&outpath)?; // no .. check } else { let mut outfile = std::fs::File::create(&outpath)?; // writes outside dest std::io::copy(&mut file, &mut outfile)?; }
The crate is unmaintained (latest release 0.3.1, 2024-10-22) and no fixed version is available.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In `SafeReleaseRepoActions::extract_release_archive`'s zip branch, validate each archive entry path before writing: reject raw names containing path traversal such as `..` or absolute paths, and only create/write the entry if the resolved output path remains within `dest_dir_path`.