RUSTSEC-2026-0434: `ant-releases`: extracting a release archive can write files outside the destination directory (path traversal / zip-slip)

ant-releases downloads and unpacks release archives from the safenetwork / autonomi repositories. When it extracts an archive, it builds each output path by joining the archive entry's own name onto the destination directory, with no check for .. or absolute components — a classic "zip-slip" path traversal (CWE-22 / CWE-23). A crafted archive can therefore create or overwrite files outside the intended extraction directory.

In extractreleasearchive (src/lib.rs), the ZIP branch does:

rust let outpath = destdirpath.join(file.name()); // raw zip entry name, no containment check if file.name().endswith('/') { std::fs::createdirall(&outpath)?; // dir created outside destdir } else { let mut outfile = std::fs::File::create(&outpath)?; // file written outside destdir std::io::copy(&mut file, &mut outfile)?; }

Proof of concept

A one-entry ZIP whose entry name is ../foopwned.txt, passed to AntReleaseRepoActions::extractreleasearchive (obtained via the crate's public <dyn AntReleaseRepoActions>::defaultconfig()), writes foopwned.txt as a sibling of the destination directory, outside it. Confirmed against the published 0.4.3 crate.