CVE-2026-33056
MEDIUM6.5EPSS 0.02%tar-rs `unpack_in` can chmod arbitrary directories by following symlinks
發布日:2026/3/20修改日:2026/4/28
描述
tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45.
受影響套件(5)
- Alpine/rustfrom 0, < 1.78.0-r1
- crates.io/tarfrom 0, < 0.4.45
- crates.io/tar>= 0.0.0-0, < 0.4.45
- Debian/rustcfrom 0
- Debian/rust-tarfrom 0
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
| osv | CVSS 3.1 | MEDIUM6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
參考連結(8)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2026-33056
- ADVISORYhttps://security.alpinelinux.org/vuln/CVE-2026-33056
- ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2026-33056
- PATCHhttps://crates.io/crates/tar
- PATCHhttps://github.com/alexcrichton/tar-rs
- WEBhttps://github.com/alexcrichton/tar-rs/commit/17b1fd84e632071cb8eef9d3709bf347bd266446
- WEBhttps://github.com/alexcrichton/tar-rs/security/advisories/GHSA-j4xf-2g29-59ph
- WEBhttps://rustsec.org/advisories/RUSTSEC-2026-0067.html