PT-2026-43025

CVE-2026-5223

Published

2026-05-25

Updated

2026-06-26

Description by

CVSS 4.0

6.5

Medium

MetricsAV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Cargo versions prior to 1.96.0

Description Cargo incorrectly handled symbolic links (symlinks)—which are files that point to another file or directory—inside crate tarballs downloaded from third-party registries. This allows a malicious crate to override the source code of another crate originating from the same registry.

Recommendations Update to version 1.96.0.

Exploitability

Fix

Researchers

Christos Papakonstantinou

Vendors

Affected products

Weakness enumeration

CWE-61: UNIX Symbolic Link (Symlink) Following

Related identifiers

CVE-2026-5223

BDU:2026-08152