https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-03T05:59:03.234191+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-33056 CVE-2026-33056 — tar-rs: unpack_in can chmod arbitrary directories by following symlinks 2026-10-03T05:59:03.288934+00:00

Affected: alexcrichton tar-rs

tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45.

 https://db.gcve.eu/vuln/usn-8138-1 USN-8138-1 — rust-tar vulnerability 2026-10-03T05:59:03.289035+00:00

Affected: Ubuntu:22.04:LTS: rust-tar, Ubuntu:24.04:LTS: rust-tar, Ubuntu:25.10: rust-tar

It was discovered that tar-rs incorrectly handled symlinks when unpacking a tar archive. If a user or automated system were tricked into processing a specially crafted tar archive, a remote attacker could use this issue to modify permissions of arbitrary directories outside the extraction root, and possibly escalate privileges.