The `sn-releases` Rust crate contains a path traversal vulnerability in the `extract_release_archive` function. This function extracts archive entries using their raw names without validating for path traversal sequences like '..', allowing a malicious archive to write files outside the intended destination directory. The crate is unmaintained with no fixed version available. The vulnerability has a high severity CVSS score of 8.8.