{"id":"CVE-2026-70622","aliases":["AZL-95589","AZL-95592","AZL-95604","AZL-95607","AZL-95625","AZL-95628","AZL-95631","AZL-95655","DEBIAN-CVE-2026-70622","EUVD-2026-55682","GHSA-c2qp-v5vm-7vxf","UBUNTU-CVE-2026-70622"],"status":"published","title":"tar-rs 0.4.11 - 0.4.46 Symlink Escape via append_dir_all()","description":"tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder::append_dir_all() function that allows attackers to read files outside the intended source root directory by planting symlinks in an attacker-controlled directory. When a privileged process archives an untrusted directory, the function follows symlinks without verifying that resolved targets remain within the source root, causing out-of-bounds files to be included in the archive as regular files and disclosed to the attacker.","severity":{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0046,"percentile":0.40126,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-59"],"published":"2026-08-10T17:35:23Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"rust","fixed_in":["1.75.0-30","1.96.0-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"tardev-snapshotter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.2.0.tardev1-11"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.5.4-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kata-containers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.1.0.kata1-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kata-containers-cc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.15.0.aks0-23"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rpm-ostree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2024.4-11"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.75.0-30"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.85.0"},{"fixed":"1.96.0-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"trident","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.30.0-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rust-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.38-1","0.4.38-2","0.4.40-1","0.4.43-1","0.4.43-2","0.4.43-3","0.4.43-4","0.4.44-1","0.4.45-1","0.4.45-2","0.4.46-1"]},{"source":"osv","ecosystem":"Debian:13","package":"rust-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.43-4","0.4.44-1","0.4.45-1","0.4.45-2","0.4.46-1"]},{"source":"osv","ecosystem":"Debian:14","package":"rust-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.43-4","0.4.44-1","0.4.45-1","0.4.45-2","0.4.46-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rust-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.26-1","0.4.26-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"rust-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.26-1","0.4.37-1","0.4.37-3","0.4.37-3ubuntu0.1~esm1","0.4.37-3ubuntu0.1","0.4.37-3ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rust-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.38-2","0.4.40-1","0.4.40-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rust-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.45-1","0.4.45-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rust-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.43-4","0.4.44-1","0.4.45-1"]}],"products":[{"vendor":"alexcrichton","product":"tar-rs"},{"vendor":"composefs","product":"tar-rs"}],"references":[{"url":"https://gist.github.com/thesmartshadow/e7dac0bb690ee17b9cc142154cb11726","tags":["technical-description","exploit","evidence","report"]},{"url":"https://www.vulncheck.com/advisories/tar-rs-symlink-escape-via-append-dir-all","tags":["third-party-advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70622","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-c2qp-v5vm-7vxf"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/70xxx/CVE-2026-70622.json","tags":["advisory"]},{"url":"https://github.com/composefs/tar-rs","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-70622","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-70622","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-70622","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-70622","title":"tar-rs 0.4.11 - 0.4.46 Symlink Escape via append_dir_all()","description":"tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder::append_dir_all() function that allows attackers to read files outside the intended source root directory by planting symlinks in an attacker-controlled directory. When a privileged process archives an untrusted directory, the function follows symlinks without verifying that resolved targets remain within the source root, causing out-of-bounds files to be included in the archive as regular files and disclosed to the attacker.","status":"published","published":"2026-08-10T17:35:23.683Z","modified":"2026-08-11T02:01:40.553Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T13:35:22.169514Z"}],"euvd":[{"id":"EUVD-2026-55682","description":"tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder::append_dir_all() function that allows attackers to read files outside the intended source root directory by planting symlinks in an attacker-controlled directory. When a privileged process archives an untrusted directory, the function follows symlinks without verifying that resolved targets remain within the source root, causing out-of-bounds files to be included in the archive as regular files and disclosed to the attacker.","status":"published","published":"2026-08-10T17:35:23Z","modified":"2026-08-11T02:01:40Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:02:00.742322Z"}],"ghsa":[{"id":"GHSA-c2qp-v5vm-7vxf","title":"tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder:...","description":"tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder::append_dir_all() function that allows attackers to read files outside the intended source root directory by planting symlinks in an attacker-controlled directory. When a privileged process archives an untrusted directory, the function follows symlinks without verifying that resolved targets remain within the source root, causing out-of-bounds files to be included in the archive as regular files and disclosed to the attacker.","status":"published","published":"2026-08-10T18:32:17Z","modified":"2026-08-10T18:32:24Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T15:10:15.841734Z"}],"nvd":[{"id":"CVE-2026-70622","description":"tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder::append_dir_all() function that allows attackers to read files outside the intended source root directory by planting symlinks in an attacker-controlled directory. When a privileged process archives an untrusted directory, the function follows symlinks without verifying that resolved targets remain within the source root, causing out-of-bounds files to be included in the archive as regular files and disclosed to the attacker.","status":"published","published":"2026-08-10T18:18:50.61Z","modified":"2026-10-24T15:10:00.19Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:12:36.102748Z"}],"osv":[{"id":"CVE-2026-70622","title":"tar-rs 0.4.11 - 0.4.46 Symlink Escape via append_dir_all()","description":"tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder::append_dir_all() function that allows attackers to read files outside the intended source root directory by planting symlinks in an attacker-controlled directory. When a privileged process archives an untrusted directory, the function follows symlinks without verifying that resolved targets remain within the source root, causing out-of-bounds files to be included in the archive as regular files and disclosed to the attacker.","status":"published","published":"2026-08-10T17:35:23.683Z","modified":"2026-10-28T02:30:37.595862384Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T15:45:15.164658Z"},{"id":"DEBIAN-CVE-2026-70622","description":"tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder::append_dir_all() function that allows attackers to read files outside the intended source root directory by planting symlinks in an attacker-controlled directory. When a privileged process archives an untrusted directory, the function follows symlinks without verifying that resolved targets remain within the source root, causing out-of-bounds files to be included in the archive as regular files and disclosed to the attacker.","status":"published","published":"2026-08-10T18:18:50.61Z","modified":"2026-10-25T09:47:41.733134987Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:46:02.094661Z"},{"id":"UBUNTU-CVE-2026-70622","description":"tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder::append_dir_all() function that allows attackers to read files outside the intended source root directory by planting symlinks in an attacker-controlled directory. When a privileged process archives an untrusted directory, the function follows symlinks without verifying that resolved targets remain within the source root, causing out-of-bounds files to be included in the archive as regular files and disclosed to the attacker.","status":"published","published":"2026-08-10T18:18:00Z","modified":"2026-10-17T12:59:30.103247049Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:56:57.159276Z"},{"id":"AZL-95589","title":"CVE-2026-70622 affecting package tardev-snapshotter 3.2.0.tardev1-11","description":"tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder::append_dir_all() function that allows attackers to read files outside the intended source root directory by planting symlinks in an attacker-controlled directory. When a privileged process archives an untrusted directory, the function follows symlinks without verifying that resolved targets remain within the source root, causing out-of-bounds files to be included in the archive as regular files and disclosed to the attacker.","status":"published","published":"2026-08-10T18:18:50Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:26.077208Z"},{"id":"AZL-95592","title":"CVE-2026-70622 affecting package clamav 1.5.4-2","description":"tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder::append_dir_all() function that allows attackers to read files outside the intended source root directory by planting symlinks in an attacker-controlled directory. When a privileged process archives an untrusted directory, the function follows symlinks without verifying that resolved targets remain within the source root, causing out-of-bounds files to be included in the archive as regular files and disclosed to the attacker.","status":"published","published":"2026-08-10T18:18:50Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.077208Z"},{"id":"AZL-95604","title":"CVE-2026-70622 affecting package kata-containers 4.1.0.kata1-2","description":"tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder::append_dir_all() function that allows attackers to read files outside the intended source root directory by planting symlinks in an attacker-controlled directory. When a privileged process archives an untrusted directory, the function follows symlinks without verifying that resolved targets remain within the source root, causing out-of-bounds files to be included in the archive as regular files and disclosed to the attacker.","status":"published","published":"2026-08-10T18:18:50Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.077208Z"},{"id":"AZL-95607","title":"CVE-2026-70622 affecting package kata-containers-cc 3.15.0.aks0-23","description":"tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder::append_dir_all() function that allows attackers to read files outside the intended source root directory by planting symlinks in an attacker-controlled directory. When a privileged process archives an untrusted directory, the function follows symlinks without verifying that resolved targets remain within the source root, causing out-of-bounds files to be included in the archive as regular files and disclosed to the attacker.","status":"published","published":"2026-08-10T18:18:50Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.077208Z"},{"id":"AZL-95625","title":"CVE-2026-70622 affecting package rpm-ostree 2024.4-11","description":"tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder::append_dir_all() function that allows attackers to read files outside the intended source root directory by planting symlinks in an attacker-controlled directory. When a privileged process archives an untrusted directory, the function follows symlinks without verifying that resolved targets remain within the source root, causing out-of-bounds files to be included in the archive as regular files and disclosed to the attacker.","status":"published","published":"2026-08-10T18:18:50Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.077208Z"},{"id":"AZL-95628","title":"CVE-2026-70622 affecting package rust for versions less than 1.75.0-30","description":"tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder::append_dir_all() function that allows attackers to read files outside the intended source root directory by planting symlinks in an attacker-controlled directory. When a privileged process archives an untrusted directory, the function follows symlinks without verifying that resolved targets remain within the source root, causing out-of-bounds files to be included in the archive as regular files and disclosed to the attacker.","status":"published","published":"2026-08-10T18:18:50Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.077208Z"},{"id":"AZL-95631","title":"CVE-2026-70622 affecting package rust for versions less than 1.96.0-1","description":"tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder::append_dir_all() function that allows attackers to read files outside the intended source root directory by planting symlinks in an attacker-controlled directory. When a privileged process archives an untrusted directory, the function follows symlinks without verifying that resolved targets remain within the source root, causing out-of-bounds files to be included in the archive as regular files and disclosed to the attacker.","status":"published","published":"2026-08-10T18:18:50Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.077208Z"},{"id":"AZL-95655","title":"CVE-2026-70622 affecting package trident 0.30.0-1","description":"tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder::append_dir_all() function that allows attackers to read files outside the intended source root directory by planting symlinks in an attacker-controlled directory. When a privileged process archives an untrusted directory, the function follows symlinks without verifying that resolved targets remain within the source root, causing out-of-bounds files to be included in the archive as regular files and disclosed to the attacker.","status":"published","published":"2026-08-10T18:18:50Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.077208Z"}]}}