Executive brief
astral-tokio-tar has a path traversal in tar extraction
Affected products
- crates.io astral-tokio-tar
Junglewise Threat Intelligence
CVE-2025-59825: astral-tokio-tar has a path traversal in tar extraction
CVE-2025-59825 · Severity: medium · CVSS 4 · Published 2025-09-23
Technologies: astral-tokio-tar (crates.io). Vendors: crates.io.
Related threats
- astral-tokio-tar has a PAX Header Desynchronization issue
- Astral astral-tokio-tar PAX header desynchronization
- RUSTSEC-2026-0145 - PAX Header Desynchronization in astral-tokio-tar
- astral-tokio-tar: `unpack_in` can chmod arbitrary directories by following symlinks
- astral-tokio-tar is Vulnerable to PAX Header Desynchronization