Skip to content
OpenAdvisories
Medium USN-8139-1 1 CVE

rust-cargo-c vulnerability

Published Apr 1, 2026 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that tar-rs embedded in cargo-c incorrectly handled
symlinks when unpacking a tar archive. If a user or automated system were
tricked into processing a specially crafted tar archive, a remote attacker
could use this issue to modify permissions of arbitrary directories outside
the extraction root, and possibly escalate privileges.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 25.10 rust-cargo-c 0.10.11-1ubuntu1.1

Vulnerabilities 1

  • Medium 5.1
    CVE-2026-33056

    tar-rs: unpack_in can chmod arbitrary directories by following symlinks

    tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() fo…

    alexcrichton tar-rs rust wasmcloud Debian Ubuntu Azure Linux Alpine Wolfi crates.io

References

  • report
    https://ubuntu.com/security/CVE-2026-33056