Skip to content
OpenAdvisories
Medium USN-8138-2 1 CVE

rust-tar vulnerability

Published Apr 14, 2026 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

USN-8138-1 fixed a vulnerability in tar-rs. This update provides the
corresponding update for Ubuntu 20.04 LTS.

Original advisory details:

It was discovered that tar-rs incorrectly handled symlinks when unpacking
a tar archive. If a user or automated system were tricked into processing
a specially crafted tar archive, a remote attacker could use this issue to
modify permissions of arbitrary directories outside the extraction root,
and possibly escalate privileges.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS rust-tar 0.4.26-1ubuntu0.1

Vulnerabilities 1

  • Medium 5.1
    CVE-2026-33056

    tar-rs: unpack_in can chmod arbitrary directories by following symlinks

    tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() fo…

    alexcrichton tar-rs rust wasmcloud Debian Ubuntu Azure Linux Alpine Wolfi crates.io

References

  • report
    https://ubuntu.com/security/CVE-2026-33056