Please report it privately through GitHub's private vulnerability reporting, not in a public issue.

Include:

• What's wrong and what an attacker (or a malicious device) can do with it
• The mtp-rs version, your OS, and the device if one is involved
• Steps or a small program that reproduce it

I read reports as soon as I can and I'll reply with what I found. I'm one person, so that can take a few days. When there's a fix, I'll publish it and credit you, unless you'd rather not be named.

Only the latest release gets fixes. There are no backports, so the fix for an older version is to update. A security fix may change behavior in a minor release.