{"id":"RUSTSEC-2026-0425","aliases":[],"status":"published","title":"`nix-nar`: `Decoder::unpack` writes archive entries outside the destination directory (path traversal)","description":"`Decoder::unpack` does not safely contain the paths it extracts, so a malicious NAR\narchive can create files **outside** the destination directory — a path traversal\n(CWE-22).\n\nIn `src/dec.rs` (`Decoder::unpack`):\n\n- A symlink entry's target is written without checking where it points\n  (`src/dec.rs:153`), so the archive can create a symlink that escapes the\n  destination directory.\n- The out-of-destination containment check compares path **strings** only and does\n  not account for symlinks created earlier in the same unpack\n  (`src/dec.rs:176-181`), before reaching the write sinks\n  (`std::fs::create_dir` at `src/dec.rs:201` and `OpenOptions::open` at\n  `src/dec.rs:218`).\n- The parser also accepts entry names containing `/` (`src/parser.rs:138-147`).\n\nCombined, a malicious archive can include a symlink `a` pointing at an external\ndirectory and then an entry named `a/b`, causing `b` to be written to\n`\u003cexternal\u003e/b`, outside the destination. This can create new files anywhere the\nprocess can write (it cannot overwrite existing files), which is escalatable to code\nexecution by planting files in attacker-chosen locations.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","from":"osv"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-10-30T12:00:00Z","modified":"2026-10-30T10:45:03Z","fixes":[{"ecosystem":"crates.io","package":"nix-nar","fixed_in":["0.6.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"nix-nar","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.6.0"}]}]}],"references":[{"url":"https://crates.io/crates/nix-nar","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0425.html","tags":["advisory"]},{"url":"https://codeberg.org/scvalex/nix-nar-rs/issues/3","tags":["web"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0425","title":"`nix-nar`: `Decoder::unpack` writes archive entries outside the destination directory (path traversal)","description":"`Decoder::unpack` does not safely contain the paths it extracts, so a malicious NAR\narchive can create files **outside** the destination directory — a path traversal\n(CWE-22).\n\nIn `src/dec.rs` (`Decoder::unpack`):\n\n- A symlink entry's target is written without checking where it points\n  (`src/dec.rs:153`), so the archive can create a symlink that escapes the\n  destination directory.\n- The out-of-destination containment check compares path **strings** only and does\n  not account for symlinks created earlier in the same unpack\n  (`src/dec.rs:176-181`), before reaching the write sinks\n  (`std::fs::create_dir` at `src/dec.rs:201` and `OpenOptions::open` at\n  `src/dec.rs:218`).\n- The parser also accepts entry names containing `/` (`src/parser.rs:138-147`).\n\nCombined, a malicious archive can include a symlink `a` pointing at an external\ndirectory and then an entry named `a/b`, causing `b` to be written to\n`\u003cexternal\u003e/b`, outside the destination. This can create new files anywhere the\nprocess can write (it cannot overwrite existing files), which is escalatable to code\nexecution by planting files in attacker-chosen locations.","status":"published","published":"2026-10-30T12:00:00Z","modified":"2026-10-30T10:45:03.969086586Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:40.430679Z"}]}}