Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

uncbv

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.1crates.ioPublished

    uncbv: archive extraction is vulnerable to path traversal (zip-slip)

    Affected
    • crates.io uncbv >= 0.0.0-0, < 0.3.1
    Fixed in
    0.3.1· Vendor fix available
    Issue
    `uncbv extract` writes each archive entry to `output_dir.join(entry_filename)` using the filename stored in the archive with no check for `..` components or absolute paths. A malicious `.cbv` / `.cbz` archive whose entry name contains `../` (or an absolute path) can therefore cause files to be written outside the output directory chosen by the user. This is a "zip-slip" / directory-traversal arbitrary file write (CWE-22).

    Recommended action: Upgrade to 0.3.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.devSource checked Evidence →