CVE-2026-70622

Name of the Vulnerable Software and Affected Versions tar-rs versions 0.4.11 through 0.4.46

Description A symlink escape issue exists in the append dir all() function of the Builder module. This occurs when a privileged process archives an untrusted directory, as the function follows symbolic links (symlinks)—pointers to other files or directories—without verifying that the resolved targets remain within the intended source root. An attacker can plant symlinks in a directory they control to include files from outside the source root into the archive as regular files, leading to unauthorized file disclosure.

Recommendations Update tar-rs to a version newer than 0.4.46. As a temporary mitigation, restrict the use of the append dir all() function when processing untrusted directories.