https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 12:32:46 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-232615 EUVD-2026-232615 https://cve.radiocsirt.org/vuln/euvd-2026-232615 https://cve.radiocsirt.org/vuln/fkie_cve-2022-39215 <p>Tauri is a framework for building binaries for all major desktop platforms. Due to missing canonicalization when `readDir` is called recursively, it was possible to display directory listings outside of the defined `fs` scope. This required a crafted symbolic link or junction folder inside an allowed path of the `fs` scope. No arbitrary file content could be leaked. The issue has been resolved in version 1.0.6 and the implementation now properly checks if the requested (sub) directory is a symbolic link outside of the defined `scope`. Users are advised to upgrade. Users unable to upgrade should disable the `readDir` endpoint in the `allowlist` inside the `tauri.conf.json`.</p> <p>Tauri is a framework for building binaries for all major desktop platforms. Due to missing canonicalization when `readDir` is called recursively, it was possible to display directory listings outside of the defined `fs` scope. This required a crafted symbolic link or junction folder inside an allowed path of the `fs` scope. No arbitrary file content could be leaked. The issue has been resolved in version 1.0.6 and the implementation now properly checks if the requested (sub) directory is a symbolic link outside of the defined `scope`. Users are advised to upgrade. Users unable to upgrade should disable the `readDir` endpoint in the `allowlist` inside the `tauri.conf.json`.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-39215 https://cve.radiocsirt.org/vuln/ghsa-28m8-9j7v-x499 <p><strong>Affected:</strong> crates.io: tauri</p> <p>### Impact Due to missing canonicalization when `readDir` is called recursively, it was possible to display directory listings outside of the defined `fs` scope. This required a crafted symbolic link or junction folder inside an allowed path of the `fs` scope. No arbitrary file content could be leaked.</p> <p>### Patches The issue has been resolved in https://github.com/tauri-apps/tauri/pull/5123 and the implementation now properly checks if the requested (sub) directory is a symbolic link outside of the defined `scope`.</p> <p>### Workarounds Disable the `readDir` endpoint in the `allowlist` inside the `tauri.conf.json`.</p> <p>### For more information</p> <p>This issue was initially reported by [martin-ocasek]( https://github.com/martin-ocasek) in [#4882](https://github.com/tauri-apps/tauri/issues/4882).</p> <p>If you have any questions or comments about this advisory: * Open an issue in [tauri](https://github.com/tauri-apps/tauri) * Email us at [security@tauri.app](mailto:security@tauri.app)</p> <p><strong>Affected:</strong> crates.io: tauri</p> <p>### Impact Due to missing canonicalization when `readDir` is called recursively, it was possible to display directory listings outside of the defined `fs` scope. This required a crafted symbolic link or junction folder inside an allowed path of the `fs` scope. No arbitrary file content could be leaked.</p> <p>### Patches The issue has been resolved in https://github.com/tauri-apps/tauri/pull/5123 and the implementation now properly checks if the requested (sub) directory is a symbolic link outside of the defined `scope`.</p> <p>### Workarounds Disable the `readDir` endpoint in the `allowlist` inside the `tauri.conf.json`.</p> <p>### For more information</p> <p>This issue was initially reported by [martin-ocasek]( https://github.com/martin-ocasek) in [#4882](https://github.com/tauri-apps/tauri/issues/4882).</p> <p>If you have any questions or comments about this advisory: * Open an issue in [tauri](https://github.com/tauri-apps/tauri) * Email us at [security@tauri.app](mailto:security@tauri.app)</p> https://cve.radiocsirt.org/vuln/ghsa-28m8-9j7v-x499 https://cve.radiocsirt.org/vuln/gsd-2022-39215 gsd-2022-39215 https://cve.radiocsirt.org/vuln/gsd-2022-39215 https://cve.radiocsirt.org/vuln/rustsec-2022-0088 <p><strong>Affected:</strong> crates.io: tauri</p> <p>It is possible for `readDir` to incorrectly enumerate files from a symlinked directory if called recursively when specifying an empty string for the dir parameter as outlined in [this](https://github.com/tauri-apps/tauri/issues/4882) issue.</p> <p>This is corrected in [this](https://github.com/tauri-apps/tauri/pull/5123) PR by checking if a directory is a symlink before reading from it.</p> <p><strong>Affected:</strong> crates.io: tauri</p> <p>It is possible for `readDir` to incorrectly enumerate files from a symlinked directory if called recursively when specifying an empty string for the dir parameter as outlined in [this](https://github.com/tauri-apps/tauri/issues/4882) issue.</p> <p>This is corrected in [this](https://github.com/tauri-apps/tauri/pull/5123) PR by checking if a directory is a symlink before reading from it.</p> https://cve.radiocsirt.org/vuln/rustsec-2022-0088