Skip to main content
cve.nowby Sazabi
← Vulnerabilities
RUSTSEC-2026-0434

`ant-releases`: extracting a release archive can write files outside the destination directory (path traversal / zip-slip)

Exploited
No known exploitation
Fix
No fix listed
Who is exposed
Specific setups only

Do first: Check whether your setup matches what the bug needs. Archive is extracted through the ZIP branch of extract_release_archive

Published
Last modified
27/100
Specific setups only
None on Exploit-DB, Metasploit or GitHub

Summary

The `ant-releases` Rust crate, which downloads and unpacks release archives for the `safe_network` and `autonomi` projects, is affected. A specially crafted ZIP archive can make it create or overwrite files outside the intended extraction directory, which could let an attacker modify arbitrary files that the running user can write to.

Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.

Read the original description

ant-releases downloads and unpacks release archives from the safe_network / autonomi repositories. When it extracts an archive, it builds each output path by joining the archive entry's own name onto the destination directory, with no check for .. or absolute components — a classic "zip-slip" path traversal (CWE-22 / CWE-23). A crafted archive can therefore create or overwrite files outside the intended extraction directory.

In extract_release_archive (src/lib.rs), the ZIP branch does:

let out_path = dest_dir_path.join(file.name());   // raw zip entry name, no containment check
if file.name().ends_with('/') {
    std::fs::create_dir_all(&out_path)?;          // dir created outside dest_dir
} else {
    let mut outfile = std::fs::File::create(&out_path)?;   // file written outside dest_dir
    std::io::copy(&mut file, &mut outfile)?;
}

Proof of concept

A one-entry ZIP whose entry name is ../foo_pwned.txt, passed to AntReleaseRepoActions::extract_release_archive (obtained via the crate's public <dyn AntReleaseRepoActions>::default_config()), writes foo_pwned.txt as a sibling of the destination directory, outside it. Confirmed against the published 0.4.3 crate.

cve.now Index

27cve.now Index 27 of 100 · methodology v3
  • Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
  • Exposure12/25Specific setups only, reachable over the network without a login
  • Reach10/20Affects crates.io packages
  • Severity?/10Unknown. No CVSS score or vendor rating
  • No patch5/5No patch listed yet

What would change the score

  • Would score about 77 if added to CISA KEV
  • Would score about 72 if CISA's SSVC rates exploitation active

How the score works · Rankings

What to do

  • Check whether your setup matches what the bug needs.

    Archive is extracted through the ZIP branch of extract_release_archive

  • Workaround: The checked facts give no workaround. Until a fix or guidance is published, avoid passing archives from untrusted sources to extract_release_archive.

Timeline

  1. Advisory published2 days
  2. Record last updated
  3. First seen by cve.now

Affected versions

Evidence 3

  1. Advisory
  2. Repository
  3. Link

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

Questions about RUSTSEC-2026-0434

Is RUSTSEC-2026-0434 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data

What does this mean?

A crafted ZIP archive passed to extract_release_archive can create or overwrite files outside the intended extraction directory. This is a path traversal (zip-slip) flaw in how archive entry paths are handled.Source: rustsec.org

Which versions are affected by RUSTSEC-2026-0434?

ant-releases (crates.io): from 0.0.0-0.Source: cve.now feed data

Am I affected, and how do I check?

The checked facts list ant-releases with no fixed version, so all versions in the range starting at 0.0.0-0 are listed as affected. The issue applies when an archive is extracted through the ZIP branch of extract_release_archive. To check your own code, look for calls to extract_release_archive that handle ZIP files.Source: rustsec.org

How do I fix RUSTSEC-2026-0434?

The checked facts do not name a fixed version, so no upgrade target is confirmed. Check the RUSTSEC-2026-0434 advisory for an updated release before relying on any version.Source: rustsec.org

What if there's no patch?

The checked facts give no workaround. Until a fix or guidance is published, avoid passing archives from untrusted sources to extract_release_archive.Source: rustsec.org

Sources

Related

More vulnerabilities