Is CVE-2026-70622 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-70622 being exploited in the wild.

How severe is CVE-2026-70622?

Medium severity, with a CVSS score of 6.5, published 10 August 2026.

Which products and versions are affected?

rust-lang tar-rs 0.4.11 through 0.4.46.

Is there a fix for CVE-2026-70622?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-70622 attacked?

It is attacked over the network or with local access, in a software library.

Am I affected by CVE-2026-70622?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-70622: tar-rs symlink escape in append_dir_all

CVE-2026-70622 · Severity: medium · CVSS 6.5 · Published 2026-08-10

tar-rs is a Rust library for reading and writing TAR archives. The Builder::append_dir_all() function follows symlinks by default without verifying that the target files remain within the source directory boundary. An attacker who controls a directory being archived by a privileged process can plant symlinks pointing to sensitive files, allowing the attacker to read files they don't have direct access to (privilege escalation / unauthorized file disclosure).

Quick answers

Is CVE-2026-70622 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-70622 being exploited in the wild.
How severe is CVE-2026-70622?: Medium severity, with a CVSS score of 6.5, published 10 August 2026.
Which products and versions are affected?: rust-lang tar-rs 0.4.11 through 0.4.46.
Is there a fix for CVE-2026-70622?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-70622 attacked?: It is attacked over the network or with local access, in a software library.
Am I affected by CVE-2026-70622?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a symlink escape (CWE-59) in the append_dir_all() function. The root cause is a mismatch between archive boundary enforcement and filesystem traversal: archive entry names are confined to the source root via strip_prefix(), but the function follows symlinks through is_dir(), read_dir(), metadata(), and File::open() without verifying that dereferenced targets remain within src_path. By default, follow_symlinks(true) is set; an attacker controlling a directory passed to append_dir_all() can plant symlinks pointing outside it. The resulting archive contains the target file contents as regular files. Attack requires: (1) control of a directory being archived, and (2) the archiving process running with higher privileges. No patch is currently available in released versions; the vulnerability persists in the main branch as of the advisory date.

Affected products

rust-lang tar-rs 0.4.11 through 0.4.46

Timeline

2026-08-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.