CVE-2026-33056
published 2026-03-20CVE-2026-33056: tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses…
PriorityP337medium6.5CVSS 3.1
AVNACLPRNUIRSUCNIHAN
EPSS
0.38%
30.2th percentile
tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| alexcrichton | tar-rs | < 0.4.45 | 0.4.45 |
| debian | rust-tar | < rust-tar 0.4.45-1 (forky) | rust-tar 0.4.45-1 (forky) |
| debian | rustc | < rust-tar 0.4.45-1 (forky) | rust-tar 0.4.45-1 (forky) |
| gnu | tar | >= 0 < 0.4.45 | 0.4.45 |
| gnu | tar | >= 0.0.0-0 < 0.4.45 | 0.4.45 |
| msrc | azl3_kata-containers-cc_3.15.0.aks0-7_on_azure_linux_3.0 | — | — |
| msrc | azl3_rpm-ostree_2024.4-6_on_azure_linux_3.0 | — | — |
| msrc | azl3_rust_1.75.0-25_on_azure_linux_3.0 | — | — |
| msrc | azl3_rust_1.90.0-4_on_azure_linux_3.0 | — | — |
| msrc | azl3_trident_0.21.0-1_on_azure_linux_3.0 | — | — |
| msrc | cbl2_kata-containers-cc_3.2.0.azl2-8_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_kata-containers_3.2.0.azl2-7_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_rpm-ostree_2022.1-8_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_rust_1.72.0-14_on_cbl_mariner_2.0 | — | — |
| tar_project | tar | < 0.4.45 | 0.4.45 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
nvdv4.05.1MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv5.1MEDIUM
vendor_debian5.1MEDIUM
vendor_msrc5.1MEDIUM
vendor_redhat5.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
tar-rs vulnerability
vendor_ubuntu·2026-04-14
CVE-2026-33056 tar-rs vulnerability
Title: tar-rs vulnerability
Summary: tar-rs could be made to modify permissions on arbitrary directories.
USN-8138-1 fixed a vulnerability in tar-rs. This update provides the
corresponding update for Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that tar-rs incorrectly handled symlinks when unpacking
a tar archive. If a user or automated system were tricked into processing
a specially crafted tar archive, a remote attacker could use this issue to
modify permissions of arbitrary directories outside the extraction root,
and possibly escalate privileges.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Rust vulnerability
vendor_ubuntu·2026-04-14
CVE-2026-33056 Rust vulnerability
Title: Rust vulnerability
Summary: rustc could be made to modify permissions on arbitrary directories.
USN-8168-1 fixed a vulnerability in Rust. This update provides the
corresponding update to Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04
LTS and Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that tar-rs embedded in rustc incorrectly handled
symlinks when unpacking a tar archive. If a user or automated system were
tricked into processing a specially crafted tar archive, a remote attacker
could use this issue to modify permissions of arbitrary directories
outside the extraction root, and possibly escalate privileges.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Rust vulnerability
vendor_ubuntu·2026-04-13
CVE-2026-33056 Rust vulnerability
Title: Rust vulnerability
Summary: rustc could be made to modify permissions on arbitrary directories.
It was discovered that tar-rs embedded in rustc incorrectly handled
symlinks when unpacking a tar archive. If a user or automated system were
tricked into processing a specially crafted tar archive, a remote attacker
could use this issue to modify permissions of arbitrary directories outside
the extraction root, and possibly escalate privileges.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
tar-rs vulnerability
vendor_ubuntu·2026-04-01
CVE-2026-33056 tar-rs vulnerability
Title: tar-rs vulnerability
Summary: tar-rs could be made to modify permissions on arbitrary directories.
It was discovered that tar-rs incorrectly handled symlinks when unpacking a
tar archive. If a user or automated system were tricked into processing a
specially crafted tar archive, a remote attacker could use this issue to
modify permissions of arbitrary directories outside the extraction root,
and possibly escalate privileges.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
cargo-c vulnerability
vendor_ubuntu·2026-04-01
CVE-2026-33056 cargo-c vulnerability
Title: cargo-c vulnerability
Summary: cargo-c could be made to modify permissions on arbitrary directories.
It was discovered that tar-rs embedded in cargo-c incorrectly handled
symlinks when unpacking a tar archive. If a user or automated system were
tricked into processing a specially crafted tar archive, a remote attacker
could use this issue to modify permissions of arbitrary directories outside
the extraction root, and possibly escalate privileges.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
tar-rs: tar-rs: Arbitrary directory permission modification via crafted tar archive
vendor_redhat·2026-03-20·CVSS 5.1
CVE-2026-33056 [MEDIUM] CWE-59 tar-rs: tar-rs: Arbitrary directory permission modification via crafted tar archive
tar-rs: tar-rs: Arbitrary directory permission modification via crafted tar archive
tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45.
A flaw was found in tar-rs, a Rust library for reading and writing tar archiv
Microsoft
tar-rs: unpack_in can chmod arbitrary directories by following symlinks
vendor_msrc·2026-03-10·CVSS 5.1
CVE-2026-33056 [MEDIUM] CWE-61 tar-rs: unpack_in can chmod arbitrary directories by following symlinks
tar-rs: unpack_in can chmod arbitrary directories by following symlinks
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Debian
CVE-2026-33056: rust-tar - tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and...
vendor_debian·2026·CVSS 5.1
CVE-2026-33056 [MEDIUM] CVE-2026-33056: rust-tar - tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and...
tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 0.4.45-1)
sid: resolved (fixed in 0.4.45-1)
trixie: open
OSV
tar-rs `unpack_in` can chmod arbitrary directories by following symlinks
osv·2026-03-20
CVE-2026-33056 [MEDIUM] tar-rs `unpack_in` can chmod arbitrary directories by following symlinks
tar-rs `unpack_in` can chmod arbitrary directories by following symlinks
## Summary
When unpacking a tar archive, the `tar` crate's `unpack_dir` function uses `fs::metadata()` to check whether a path that already exists is a directory. Because `fs::metadata()` follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply `chmod` to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root.
## Reproducer
A malicious tarball contains two entries: (1) a symlink `foo` pointing to an arbitrary external directory, and (2) a directory entry `foo/.` (or just `foo`). When unpacked, `create_dir
GHSA
tar-rs `unpack_in` can chmod arbitrary directories by following symlinks
ghsa·2026-03-20
CVE-2026-33056 [MEDIUM] CWE-61 tar-rs `unpack_in` can chmod arbitrary directories by following symlinks
tar-rs `unpack_in` can chmod arbitrary directories by following symlinks
## Summary
When unpacking a tar archive, the `tar` crate's `unpack_dir` function uses `fs::metadata()` to check whether a path that already exists is a directory. Because `fs::metadata()` follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply `chmod` to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root.
## Reproducer
A malicious tarball contains two entries: (1) a symlink `foo` pointing to an arbitrary external directory, and (2) a directory entry `foo/.` (or just `foo`). When unpacked, `create_dir
OSV
CVE-2026-33056: tar-rs is a tar archive reading/writing library for Rust
osv·2026-03-20·CVSS 5.1
CVE-2026-33056 [MEDIUM] CVE-2026-33056: tar-rs is a tar archive reading/writing library for Rust
tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45.
OSV
`unpack_in` can chmod arbitrary directories by following symlinks
osv·2026-03-19
CVE-2026-33056 `unpack_in` can chmod arbitrary directories by following symlinks
`unpack_in` can chmod arbitrary directories by following symlinks
In versions 0.4.44 and below of tar-rs, when unpacking a tar archive, the tar
crate's `unpack_dir` function uses [`fs::metadata()`][fs-metadata] to check
whether a path that already exists is a directory. Because `fs::metadata()`
follows symbolic links, a crafted tarball containing a symlink entry followed
by a directory entry with the same name causes the crate to treat the symlink
target as a valid existing directory — and subsequently apply chmod to it. This
allows an attacker to modify the permissions of arbitrary directories outside
the extraction root.
This issue has been fixed in version 0.4.45.
[fs-metadata]: https://doc.rust-lang.org/std/fs/fn.metadata.html
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-33056 rust: tar-rs: Arbitrary directory permission modification via crafted tar archive [fedora-all]
bugzilla·2026-03-20·CVSS 5.1
CVE-2026-33056 [MEDIUM] CVE-2026-33056 rust: tar-rs: Arbitrary directory permission modification via crafted tar archive [fedora-all]
CVE-2026-33056 rust: tar-rs: Arbitrary directory permission modification via crafted tar archive [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
More information is available at https://www.cve.org/CVERecord?id=CVE-2026-33056. This flaw is fixed in version 0.4.45 of the tar crate. Updates for rust-tar-0.4.45 are in testing for all Fedora and EPEL branches, and buildroot overrides are active. However, since rust uses vendored Rust crate dependencies (it looks like its copy of tar is at 0.4.44), its maintainers would need to fix this separately within the package’s dependency bundle or wait
Bugzilla
CVE-2026-33056 goose: tar-rs: Arbitrary directory permission modification via crafted tar archive [fedora-all]
bugzilla·2026-03-20·CVSS 5.1
CVE-2026-33056 [MEDIUM] CVE-2026-33056 goose: tar-rs: Arbitrary directory permission modification via crafted tar archive [fedora-all]
CVE-2026-33056 goose: tar-rs: Arbitrary directory permission modification via crafted tar archive [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
More information is available at https://www.cve.org/CVERecord?id=CVE-2026-33056. This flaw is fixed in version 0.4.45 of the tar crate. Updates for rust-tar-0.4.45 are in testing for all Fedora and EPEL branches, and buildroot overrides are active. However, since goose uses vendored Rust crate dependencies, its maintainers would need to fix this separately within the package’s dependency bundle.
---
FEDORA-2026-6ff3ef2d32 (goose-1.23.2-8.fc44)
Bugzilla
CVE-2026-33056 bpfman: tar-rs: Arbitrary directory permission modification via crafted tar archive [fedora-all]
bugzilla·2026-03-20·CVSS 5.1
CVE-2026-33056 [MEDIUM] CVE-2026-33056 bpfman: tar-rs: Arbitrary directory permission modification via crafted tar archive [fedora-all]
CVE-2026-33056 bpfman: tar-rs: Arbitrary directory permission modification via crafted tar archive [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
More information is available at https://www.cve.org/CVERecord?id=CVE-2026-33056. This flaw is fixed in version 0.4.45 of the tar crate. Updates for rust-tar-0.4.45 are in testing for all Fedora and EPEL branches, and buildroot overrides are active. However, since bpfman uses vendored Rust crate dependencies, its maintainers would need to fix this separately within the package’s dependency bundle.
---
Scratch build with the bumped version here
Bugzilla
CVE-2026-33056 tar-rs: tar-rs: Arbitrary directory permission modification via crafted tar archive
bugzilla·2026-03-20·CVSS 6.5
CVE-2026-33056 [MEDIUM] CVE-2026-33056 tar-rs: tar-rs: Arbitrary directory permission modification via crafted tar archive
CVE-2026-33056 tar-rs: tar-rs: Arbitrary directory permission modification via crafted tar archive
tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45.
Bugzilla
CVE-2026-33056 fido-device-onboard: tar-rs: Arbitrary directory permission modification via crafted tar archive [fedora-all]
bugzilla·2026-03-20·CVSS 5.1
CVE-2026-33056 [MEDIUM] CVE-2026-33056 fido-device-onboard: tar-rs: Arbitrary directory permission modification via crafted tar archive [fedora-all]
CVE-2026-33056 fido-device-onboard: tar-rs: Arbitrary directory permission modification via crafted tar archive [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
More information is available at https://www.cve.org/CVERecord?id=CVE-2026-33056. This flaw is fixed in version 0.4.45 of the tar crate. Updates for rust-tar-0.4.45 are in testing for all Fedora and EPEL branches, and buildroot overrides are active. Therefore, you can fix this in Fedora at any time by simply rebuilding fido-device-onboard. I’m not going to do that now because rust-sig is not a co-maintainer, but I can do it as prove
Bugzilla
CVE-2026-25727 fido-device-onboard: time affected by a stack exhaustion denial of service attack [fedora-43]
bugzilla·2026-02-09·CVSS 6.8
CVE-2026-25727 [MEDIUM] CVE-2026-25727 fido-device-onboard: time affected by a stack exhaustion denial of service attack [fedora-43]
CVE-2026-25727 fido-device-onboard: time affected by a stack exhaustion denial of service attack [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
Proposed as a Freeze Exception for 44-final by Fedora user pbrobinson using the blocker tracking app because:
Plus 2449677. Included in IoT Edition as a default package so would like to fix CVE-2026-25727, CVE-2026-33056 for GA images.
---
FEDORA-2026-9e223ca14f (fido-device-onboard-0.5.5-8.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-9e223ca14f
---
FEDORA-2026-e6237c2efe (fido-device-
Wiz
CVE-2026-33056 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.1
CVE-2026-33056 [MEDIUM] CVE-2026-33056 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-33056 :
Rust vulnerability analysis and mitigation
tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45.
Source : NVD
## 5.1
Score
Published March 20, 2026
Severity MEDIUM
CNA Score 5.1
Affected
2026-03-20
Published