CVE-2026-70622

Received Received - Intake

Symlink Escape Vulnerability in tar-rs Archive Builder

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: VulnCheck

Description

tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder::append_dir_all() function that allows attackers to read files outside the intended source root directory by planting symlinks in an attacker-controlled directory. When a privileged process archives an untrusted directory, the function follows symlinks without verifying that resolved targets remain within the source root, causing out-of-bounds files to be included in the archive as regular files and disclosed to the attacker.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-70622

EUVD

EUVD-2026-55682

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

Executive Summary

This vulnerability is a symlink escape issue in the tar-rs library versions 0.4.11 through 0.4.46. The Builder::append_dir_all() function follows symlinks without checking if they stay within the intended source directory. Attackers can exploit this by placing symlinks in a directory they control, tricking privileged processes into including files outside the source root in the archive.

Detection Guidance

To detect this vulnerability, inspect systems using tar-rs versions 0.4.11 through 0.4.46. Check for untrusted directories being archived by privileged processes. Commands like 'cargo audit' or 'cargo outdated' may help identify vulnerable versions. Review archive creation logs for symlink-related operations.

Impact Analysis

If you use tar-rs to archive untrusted directories with elevated privileges, attackers could access sensitive files outside the intended directory. This could lead to unauthorized file disclosure, data leaks, or exposure of confidential information depending on the files present.

Mitigation Strategies

Update tar-rs to a version outside the vulnerable range (0.4.11-0.4.46). Avoid archiving untrusted directories with privileged processes. Implement input validation to prevent symlink traversal. Restrict permissions on directories being archived.

Hi! I’m here to help you understand CVE-2026-70622. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70