4 matches found
RUSTSEC-2026-0434 `ant-releases`: extracting a release archive can write files outside the destination directory (path traversal / zip-slip)
ant-releases downloads and unpacks release archives from the safenetwork / autonomi repositories. When it extracts an archive, it builds each output path by joining the archive entry's own name onto the destination directory, with no check for .. or absolute components — a classic "zip-slip" path...
`ant-releases`: extracting a release archive can write files outside the destination directory (path traversal / zip-slip)
ant-releases downloads and unpacks release archives from the safenetwork / autonomi repositories. When it extracts an archive, it builds each output path by joining the archive entry's own name onto the destination directory, with no check for .. or absolute components — a classic "zip-slip" path...
`sn-releases`: `extract_release_archive` writes archive entries without a path-traversal check (zip-slip)
SafeReleaseRepoActions::extractreleasearchive builds each output path from the raw archive entry name and writes to it with no traversal check, so a malicious release archive can create directories and write files outside the destination directory, a "zip-slip" / path traversal CWE-22 / CWE-23. I...
RUSTSEC-2026-0427 `sn-releases`: `extract_release_archive` writes archive entries without a path-traversal check (zip-slip)
SafeReleaseRepoActions::extractreleasearchive builds each output path from the raw archive entry name and writes to it with no traversal check, so a malicious release archive can create directories and write files outside the destination directory, a "zip-slip" / path traversal CWE-22 / CWE-23. I...