p PatchFirst

CVE-2026-70622

CVE-2026-70622 · tar-rs 0.4.11 - 0.4.46 Symlink Escape via append_dir_all()

This page contains facts from public vulnerability sources. Check the original advisory before updating.

tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder::append_dir_all() function that allows attackers to read files outside the intended source root directory by planting symlinks in an attacker-controlled directory. When a privileged process archives an untrusted directory, the function follows symlinks without verifying that resolved targets remain within the source root, causing out-of-bounds files to be included in the archive as regular files and disclosed to the attacker.

CVSS 7.1 · High · EPSS 0.5%

Published
Updated

Stack: system

Affected products and versions

  • tar-rs

    Versions
    • ≥ 0.4.11, ≤ 0.4.46: Affected (semver)

    No fix published

  • rust-tar Debian:12

    Versions
    • 0.4.38-1
    • 0.4.38-2
    • 0.4.40-1
    • 0.4.43-1
    • 0.4.43-2
    • 0.4.43-3
    • 0.4.43-4
    • 0.4.44-1
    • 0.4.45-1
    • 0.4.45-2
    • 0.4.46-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rust-tar Debian:13

    Versions
    • 0.4.43-4
    • 0.4.44-1
    • 0.4.45-1
    • 0.4.45-2
    • 0.4.46-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rust-tar Debian:14

    Versions
    • 0.4.43-4
    • 0.4.44-1
    • 0.4.45-1
    • 0.4.45-2
    • 0.4.46-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rust-tar Ubuntu:Pro:20.04:LTS

    Versions
    • 0.4.26-1
    • 0.4.26-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rust-tar Ubuntu:Pro:22.04:LTS

    Versions
    • 0.4.26-1
    • 0.4.37-1
    • 0.4.37-3
    • 0.4.37-3ubuntu0.1~esm1
    • 0.4.37-3ubuntu0.1
    • 0.4.37-3ubuntu0.1+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rust-tar Ubuntu:24.04:LTS

    Versions
    • 0.4.38-2
    • 0.4.40-1
    • 0.4.40-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rust-tar Ubuntu:26.10

    Versions
    • 0.4.45-1
    • 0.4.45-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rust-tar Ubuntu:26.04:LTS

    Versions
    • 0.4.43-4
    • 0.4.44-1
    • 0.4.45-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →