`sn-releases`: `extract_release_archive` writes archive entries without a path-traversal check (zip-slip)

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

`SafeReleaseRepoActions::extract_release_archive` builds each output path from the **raw archive entry name** and writes to it with no traversal check, so a malicious release archive can create directories and write files **outside** the destination directory, a "zip-slip" / path traversal (CWE-22 / CWE-23). In `src/lib.rs` (`extract_release_archive`, zip branch): ```rust let mut file = archive.by_index(i)?; let out_path = dest_dir_path.join(file.name()); // file.name() is the raw entry name if file.name().ends_with('/') { std::fs::create_dir_all(&out_path)?; // no `..` check } else { let mut outfile = std::fs::File::create(&out_path)?; // writes outside dest std::io::copy(&mut file, &mut outfile)?; } ``` The crate is unmaintained (latest release 0.3.1, 2024-10-22) and no fixed version is available.

Source published

29 Oct 2026 12:00:00 UTC

Source modified

30 Oct 2026 11:15:02 UTC

Observed here

30 Oct 2026 11:49:33 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H