Skip to content
OpenAdvisories
Medium USN-8138-1 1 CVE

rust-tar vulnerability

Published Apr 1, 2026 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that tar-rs incorrectly handled symlinks when unpacking a
tar archive. If a user or automated system were tricked into processing a
specially crafted tar archive, a remote attacker could use this issue to
modify permissions of arbitrary directories outside the extraction root,
and possibly escalate privileges.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS rust-tar 0.4.37-3ubuntu0.1
Ubuntu · 24.04 LTS 24.04:LTS rust-tar 0.4.40-1ubuntu0.1
Ubuntu · 25.10 rust-tar 0.4.43-4ubuntu0.1

Vulnerabilities 1

  • Medium 5.1
    CVE-2026-33056

    tar-rs: unpack_in can chmod arbitrary directories by following symlinks

    tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() fo…

    alexcrichton tar-rs rust wasmcloud Debian Ubuntu Azure Linux Alpine Wolfi crates.io

References

  • report
    https://ubuntu.com/security/CVE-2026-33056