Vulnerability · Published Aug 10, 2026 · Assigned by VulnCheck

CVE-2026-70622tar-rs 0.4.11 - 0.4.46 Symlink Escape via append_dir_all()

Medium 6.5

In plain English

A medium-severity security flaw in tar-rs from composefs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.5%top 60.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder::append_dir_all() function that allows attackers to read files outside the intended source root directory by planting symlinks in an attacker-controlled directory. When a privileged process archives an untrusted directory, the function follows symlinks without verifying that resolved targets remain within the source root, causing out-of-bounds files to be included in the archive as regular files and disclosed to the attacker.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	rust-tar	no fix listed	DEBIAN-CVE-2026-70622
Debian:13	rust-tar	no fix listed	DEBIAN-CVE-2026-70622
Debian:14	rust-tar	no fix listed	DEBIAN-CVE-2026-70622
Ubuntu:24.04:LTS	rust-tar	no fix listed	UBUNTU-CVE-2026-70622
Ubuntu:26.04:LTS	rust-tar	no fix listed	UBUNTU-CVE-2026-70622
Ubuntu:26.10	rust-tar	no fix listed	UBUNTU-CVE-2026-70622

Affected products (as reported)

Vendor	Product	Versions
composefs	tar-rs	0.4.11 – through 0.4.46

Weakness: CWE-59 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Researcher Disclosure technical-description, exploit
https://www.vulncheck.com/advisories/tar-rs-symlink-escape-via-append-dir-all third-party-advisory