Skip to content
OpenAdvisories

Package · Ubuntu

rust-astral-tokio-tar

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.1
    CVE-2026-33056

    tar-rs: unpack_in can chmod arbitrary directories by following symlinks

    tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() fo…

    alexcrichton tar-rs rust wasmcloud Debian Ubuntu Azure Linux Alpine Wolfi crates.io
  • Medium 6.1
    CVE-2025-59825

    astral-tokio-tar has a path traversal in tar extraction

    astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.3 and earlier of astral-tokio-tar, tar archives may extract outside of their intended destination directory when using the Entry::unpack_in_raw API. Additionally, the En…

    astral-sh tokio-tar astral-tokio-tar rust-astral-tokio-tar Debian Ubuntu crates.io