High, CVSS 7.1crates.ioPublished
ocipkg: unpacking an OCI archive can write and delete files outside the local image store (path traversal)
- Affected
- crates.io ocipkg >= 0.0.0-0, < 0.4.1
- Fixed in
- 0.4.1· Vendor fix available
- Issue
- When `ocipkg` unpacks an OCI archive, the destination directory is derived from the image name, which `ocipkg` reads from the archive's own `index.json` (`org.opencontainers.image.ref.name`). That name is attacker-controlled, and `ImageName::parse` accepts a hostname of `..`, so the computed destination escapes the local image store. A "zip-slip"-style path traversal (CWE-22 / CWE-23). This is esclatable to code execution. In `Artifact::unpack` (`src/image/artifact.rs`), the destination is `image_dir(name) = data_dir().join(name.as_path())` (`src/local/mod.rs:31`), where the name comes from `get_name_from_index` (`src/image/layout.rs:114-124`): ```rust let image_name = self.base.get_name()?; // from the archive's index.json ref.name let dest = image_dir(&image_name)?; // data_dir().join(name.as_path()); hostname ".." escapes if dest.exists() { if overwrite { fs::remove_dir_all(&dest)?; // deletes a directory OUTSIDE the store } } fs::create_dir_all(&dest)?; // ... each tar layer…
Recommended action: Upgrade to 0.4.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.