https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T18:58:33.493637+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-33056 CVE-2026-33056 — tar-rs: unpack_in can chmod arbitrary directories by following symlinks 2026-10-10T18:58:33.527381+00:00

Affected: alexcrichton tar-rs

tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45.

 https://cve.radiocsirt.org/vuln/rustsec-2026-0067 RUSTSEC-2026-0067 — `unpack_in` can chmod arbitrary directories by following symlinks 2026-10-10T18:58:33.527446+00:00

Affected: crates.io: tar

In versions 0.4.44 and below of tar-rs, when unpacking a tar archive, the tar crate's `unpack_dir` function uses [`fs::metadata()`][fs-metadata] to check whether a path that already exists is a directory. Because `fs::metadata()` follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root.

This issue has been fixed in version 0.4.45.

[fs-metadata]: https://doc.rust-lang.org/std/fs/fn.metadata.html