Vulnerability · Published Sep 23, 2025 · Assigned by GitHub_M
CVE-2025-59825astral-tokio-tar has a path traversal in tar extraction
Medium 6.1
In plain English
A medium-severity path traversal in tokio-tar from astral-sh. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.3 and earlier of astral-tokio-tar, tar archives may extract outside of their intended destination directory when using the Entry::unpack_in_raw API. Additionally, the Entry::allow_external_symlinks control (which defaults to true) could be bypassed via a pair of symlinks that individually point within the destination but combine to point outside of it. These behaviors could be used individually or combined to bypass the intended security control of limiting extraction to the given directory. This in turn would allow an attacker with a malicious tar archive to perform an arbitrary file write and potentially pivot into code execution. This issue has been patched in version 0.5.4. There is no workaround other than upgrading.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | rust-astral-tokio-tar | no fix listed | DEBIAN-CVE-2025-59825 |
| Debian:14 | rust-astral-tokio-tar | 0.5.5-1 | DEBIAN-CVE-2025-59825 |
| Ubuntu:25.10 | rust-astral-tokio-tar | no fix listed | UBUNTU-CVE-2025-59825 |
| Ubuntu:26.04:LTS | rust-astral-tokio-tar | no fix listed | UBUNTU-CVE-2025-59825 |
| Ubuntu:26.10 | rust-astral-tokio-tar | no fix listed | UBUNTU-CVE-2025-59825 |
Affected products (as reported)
Weakness: CWE-22, CWE-61 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
References
- https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-3wgq-wrwc-vqmv x_refsource_CONFIRM
- https://github.com/astral-sh/uv/issues/12163 x_refsource_MISC
- https://github.com/astral-sh/tokio-tar/commit/036fdecc85c52458ace92dc9e02e9cef90684e75 x_refsource_MISC