Most recent entries from all

EUVD-2026-327617

fkie_cve-2026-45390

In OCaml-tar before 3.4.0, a crafted archive with ../ path segments in its name allows escaping the current working directory. This is not desired behavior, and tar(1) rejects such extractions, but ocaml-tar decompresses it anyway. The impact is that it allows arbitrary file writes outside of the desired extraction directory (to an attacker that can reach a tar decompression endpoint).

GHSA-x4gv-m4gg-cwm5

OSEC-2026-08 — Path traversal vulnerability in ocaml-tar

Affected: opam: tar

A malicious archive with `../` path segments in its name allows escaping the current working directory. This is not desired behavior, and tar(1) rejects such extractions, but ocaml-tar decompresses it anyway. The impact is that it allows arbitrary file write outside of the desired extraction directory to an attacker that can reach a tar decompression endpoint. In terms of severity, similar vulnerabilities in different ecosystems (python, node, go) have been assigned CVSS scores of 6.8 MEDIUM, 7.1 HIGH, and 8.2 HIGH.

## Details

Function `Tar_unix.extract` uses `Filename.concat`.

```OCaml let extract ?(filter = fun _ -> true) ~src dst = let f ?global:_ hdr () = if filter hdr then match hdr.Tar.Header.link_indicator with | Tar.Header.Link.Normal -> begin match Result.map_error unix_err_to_msg (safe Unix.(openfile (Filename.concat dst hdr.Tar.Header.file_name) [ O_WRONLY ; O_CREAT ]) hdr.Tar.Header.file_mode) with | Error _ as err -> Tar.return err | Ok dst -> try copy ~dst_fd:dst (Int64.to_int hdr.Tar.Header.file_size) with exn -> safe_close dst; Tar.return (Error (`Exn exn)) end (* TODO set owner / mode / mtime etc. *) | _ -> (* TODO handle directories, links, etc. *) let open Tar.Syntax in let* () = Tar.seek (Int64.to_int hdr.Tar.Header.file_size) in Tar.return (Ok ()) else let open Tar.Syntax in let* () =…