{"id":"RUSTSEC-2026-0328","aliases":[],"status":"published","title":"`decompress`: tar-family extractors write archive entries without a path-traversal check (tar-slip)","description":"The tar-family extractors in `decompress` (`.tar`, `.tar.gz`, `.tar.xz`,\n`.tar.bz2`, `.tar.zst`) build each output path from the **raw archive entry path**\nand write to it with no traversal check, so a malicious archive can write files\n**outside** the destination directory, a \"tar-slip\" / zip-slip path traversal\n(CWE-22 / CWE-23).\n\nIn `src/decompressors/tar_common.rs` (`tar_extract`):\n\n```rust\nlet filepath = entry.path()?;                                    // raw entry path\nlet filepath = filepath.components().skip(opts.strip).collect::\u003cPathBuf\u003e();\n                                     // strips leading components only — keeps `..`\nlet outpath = to.join(filepath);\n// ...\nlet mut outfile = fs::File::create(\u0026outpath)?;                   // writes anywhere\n```\n\n`.components().skip(opts.strip)` removes a fixed number of *leading* path\ncomponents but leaves interior `..` components intact so an entry named \ne.g. `../../../../home/\u003cuser\u003e/.bashrc`, or an absolute path, resolves **outside** \n`to`. This affects all platforms.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high","from":"osv"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2026-09-19T12:00:00Z","modified":"2026-10-03T07:30:03Z","affected":[{"source":"osv","ecosystem":"crates.io","package":"decompress","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"}]}]}],"references":[{"url":"https://crates.io/crates/decompress","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0328.html","tags":["advisory"]},{"url":"https://github.com/rusty-ferris-club/decompress/issues/21","tags":["report"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0328","title":"`decompress`: tar-family extractors write archive entries without a path-traversal check (tar-slip)","description":"The tar-family extractors in `decompress` (`.tar`, `.tar.gz`, `.tar.xz`,\n`.tar.bz2`, `.tar.zst`) build each output path from the **raw archive entry path**\nand write to it with no traversal check, so a malicious archive can write files\n**outside** the destination directory, a \"tar-slip\" / zip-slip path traversal\n(CWE-22 / CWE-23).\n\nIn `src/decompressors/tar_common.rs` (`tar_extract`):\n\n```rust\nlet filepath = entry.path()?;                                    // raw entry path\nlet filepath = filepath.components().skip(opts.strip).collect::\u003cPathBuf\u003e();\n                                     // strips leading components only — keeps `..`\nlet outpath = to.join(filepath);\n// ...\nlet mut outfile = fs::File::create(\u0026outpath)?;                   // writes anywhere\n```\n\n`.components().skip(opts.strip)` removes a fixed number of *leading* path\ncomponents but leaves interior `..` components intact so an entry named \ne.g. `../../../../home/\u003cuser\u003e/.bashrc`, or an absolute path, resolves **outside** \n`to`. This affects all platforms.","status":"published","published":"2026-09-19T12:00:00Z","modified":"2026-10-03T07:30:03.083352599Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:40.430679Z"}]}}