https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T13:34:38.951424+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-232615 EUVD-2026-232615 2026-10-03T13:34:39.033588+00:00 EUVD-2026-232615 https://cve.radiocsirt.org/vuln/fkie_cve-2022-39215 fkie_cve-2022-39215 2026-10-03T13:34:39.033625+00:00

Tauri is a framework for building binaries for all major desktop platforms. Due to missing canonicalization when `readDir` is called recursively, it was possible to display directory listings outside of the defined `fs` scope. This required a crafted symbolic link or junction folder inside an allowed path of the `fs` scope. No arbitrary file content could be leaked. The issue has been resolved in version 1.0.6 and the implementation now properly checks if the requested (sub) directory is a symbolic link outside of the defined `scope`. Users are advised to upgrade. Users unable to upgrade should disable the `readDir` endpoint in the `allowlist` inside the `tauri.conf.json`.

 https://cve.radiocsirt.org/vuln/ghsa-28m8-9j7v-x499 GHSA-28m8-9j7v-x499 — Tauri's readDir Endpoint Scope can be Bypassed With Symbolic Links 2026-10-03T13:34:39.033659+00:00

Affected: crates.io: tauri

### Impact Due to missing canonicalization when `readDir` is called recursively, it was possible to display directory listings outside of the defined `fs` scope. This required a crafted symbolic link or junction folder inside an allowed path of the `fs` scope. No arbitrary file content could be leaked.

### Patches The issue has been resolved in https://github.com/tauri-apps/tauri/pull/5123 and the implementation now properly checks if the requested (sub) directory is a symbolic link outside of the defined `scope`.

### Workarounds Disable the `readDir` endpoint in the `allowlist` inside the `tauri.conf.json`.

### For more information

This issue was initially reported by [martin-ocasek]( https://github.com/martin-ocasek) in [#4882](https://github.com/tauri-apps/tauri/issues/4882).

If you have any questions or comments about this advisory: * Open an issue in [tauri](https://github.com/tauri-apps/tauri) * Email us at [security@tauri.app](mailto:security@tauri.app)

 https://cve.radiocsirt.org/vuln/gsd-2022-39215 gsd-2022-39215 2026-10-03T13:34:39.033702+00:00 gsd-2022-39215 https://cve.radiocsirt.org/vuln/rustsec-2022-0088 RUSTSEC-2022-0088 — `tauri`'s `readDir` endpoint allows possible enumeration outside of filesystem scope 2026-10-03T13:34:39.033716+00:00

Affected: crates.io: tauri

It is possible for `readDir` to incorrectly enumerate files from a symlinked directory if called recursively when specifying an empty string for the dir parameter as outlined in [this](https://github.com/tauri-apps/tauri/issues/4882) issue.

This is corrected in [this](https://github.com/tauri-apps/tauri/pull/5123) PR by checking if a directory is a symlink before reading from it.