Rust advisories / uncbv
Vulnerability HighRUSTSEC-2026-0307 · uncbv
RUSTSEC-2026-0307: `uncbv`: archive extraction is vulnerable to path traversal (zip-slip)
Short answerA security vulnerability in the uncbv crate: `uncbv`: archive extraction is vulnerable to path traversal (zip-slip). High severity (CVSS 7.1). Fixed in 0.3.1: update to a fixed version.
| Crate | uncbv |
|---|---|
| Type | Vulnerability (code-execution) |
| Affected versions | Before 0.3.1. |
| Fixed in | 0.3.1 |
| Severity | High, CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H |
| Published | 2026-09-23 |
| Last changed | 2026-09-24 |
| Also known as | none |
What to do
- See which version you have:
cargo tree -i uncbv(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p uncbv. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for exampleuncbv = "0.3.1") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
Summary
uncbv extract writes each archive entry to output_dir.join(entry_filename) using the filename stored in the archive with no check for .. components or absolute paths. A malicious .cbv / .cbz archive whose entry name contains ../ (or an absolute path) can therefore cause files to be written outside the output directory chosen by the user. This is a "zip-slip" / directory-traversal arbitrary file write (CWE-22).
References
- Package: crates.io/crates/uncbv
- Advisory: rustsec.org/advisories/RUSTSEC-2026-0307.html
- Web: github.com/antoyo/uncbv
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Are you affected?Check your whole dependency treePaste Cargo.lock: every advisory, for your exact versions.Read it next →Also worth your time
Did this answer your question?