CVE-2026-33056
`unpack_in` can chmod arbitrary directories by following symlinks
描述
tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45.
如何修補 CVE-2026-33056
要修補 CVE-2026-33056,請將受影響套件升級到下列已修補版本。
- —升級至 1.78.0-r1 或更新版本
- —未列出修補版本
- —未列出修補版本
- —升級至 0.4.45 或更新版本
- —升級至 0.4.45 或更新版本
CVE-2026-33056 正在被利用嗎?
低 — EPSS 為 0.4%,目前沒有觀察到大規模利用活動。
受影響套件(5)
- from 0, < 1.78.0-r1
- from 0
- from 0
- from 0, < 0.4.45
- >= 0.0.0-0, < 0.4.45
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
| osv | CVSS 3.1 | MEDIUM6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |