RUSTSEC-2026-0427

SafeReleaseRepoActions::extract_release_archive builds each output path from the raw archive entry name and writes to it with no traversal check, so a malicious release archive can create directories and write files outside the destination directory, a "zip-slip" / path traversal (CWE-22 / CWE-23).

In src/lib.rs (extract_release_archive, zip branch):

let mut file = archive.by_index(i)?;
let out_path = dest_dir_path.join(file.name());   // file.name() is the raw entry name
if file.name().ends_with('/') {
    std::fs::create_dir_all(&out_path)?;          // no `..` check
} else {
    let mut outfile = std::fs::File::create(&out_path)?;   // writes outside dest
    std::io::copy(&mut file, &mut outfile)?;
}

The crate is unmaintained (latest release 0.3.1, 2024-10-22) and no fixed version is available.