---
id: RUSTSEC-2026-0307
title: '`uncbv`: archive extraction is vulnerable to path traversal (zip-slip)'
summary: '`uncbv`: archive extraction is vulnerable to path traversal (zip-slip)'
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H'
vendor: uncbv
product: uncbv
ecosystem: rust
affected:
  - 'uncbv >= 0.0.0-0, < 0.3.1'
patched:
  - uncbv 0.3.1
published: '2026-09-23'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T09:00:02.706166545Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0307'
references:
  - url: 'https://crates.io/crates/uncbv'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0307.html'
  - url: 'https://github.com/antoyo/uncbv'
tags:
  - osv
  - rust
ingestedAt: '2026-09-25T07:17:06.736Z'
---

## Overview

### Summary

`uncbv extract` writes each archive entry to `output_dir.join(entry_filename)` using the filename stored in the archive with no check for `..` components or absolute paths. A malicious `.cbv` / `.cbz` archive whose entry name contains `../` (or an absolute path) can therefore cause files to be written outside the output directory chosen by the user. This is a "zip-slip" / directory-traversal arbitrary file write (CWE-22).

## Affected packages

- `uncbv >= 0.0.0-0, < 0.3.1`

## Remediation

Upgrade to a patched release:

- `uncbv 0.3.1`