Executive brief
tar-rs is a Rust library for reading and writing TAR archives. The Builder::append_dir_all() function follows symlinks by default without verifying that the target files remain within the source directory boundary. An attacker who controls a directory being archived by a privileged process can plant symlinks pointing to sensitive files, allowing the attacker to read files they don't have direct access to (privilege escalation / unauthorized file disclosure).
Technical details
The vulnerability is a symlink escape (CWE-59) in the append_dir_all() function. The root cause is a mismatch between archive boundary enforcement and filesystem traversal: archive entry names are confined to the source root via strip_prefix(), but the function follows symlinks through is_dir(), read_dir(), metadata(), and File::open() without verifying that dereferenced targets remain within src_path. By default, follow_symlinks(true) is set; an attacker controlling a directory passed to append_dir_all() can plant symlinks pointing outside it. The resulting archive contains the target file contents as regular files. Attack requires: (1) control of a directory being archived, and (2) the archiving process running with higher privileges. No patch is currently available in released versions; the vulnerability persists in the main branch as of the advisory date.
Affected products
- rust-lang tar-rs 0.4.11 through 0.4.46
Timeline
- 2026-08-10: disclosed