https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T03:04:05.754502+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2021-38511 CVE-2021-38511 2026-10-03T03:04:05.756163+00:00

An issue was discovered in the tar crate before 0.4.36 for Rust. When symlinks are present in a TAR archive, extraction can create arbitrary directories via .. traversal.

 https://cve.radiocsirt.org/vuln/ghsa-62jx-8vmh-4mcw GHSA-62jx-8vmh-4mcw — Links in archive can create arbitrary directories 2026-10-03T03:04:05.756208+00:00

Affected: crates.io: tar

When unpacking a tarball that contains a symlink the tar crate may create directories outside of the directory it's supposed to unpack into. The function errors when it's trying to create a file, but the folders are already created at this point.