UNIX symbolic link following in tar-rs - CVE-2026-33056

Vulnerability identifier: #VU128323

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-33056

CWE-ID: CWE-61

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to modify permissions of arbitrary directories outside the extraction root.

The vulnerability exists due to symlink following in unpack_dir when unpacking a crafted tar archive. A remote attacker can supply a tarball containing a symlink entry followed by a directory entry with the same name to modify permissions of arbitrary directories outside the extraction root.

tar-rs
Fedora
Ubuntu
rust-scx_rustland
rust-scx_layered
rust-ingredients
rust-cargo-rpmstatus
chunkah
rust-tar (Ubuntu package)
rust-tar
bpfman
rust-scx_rusty
rust-cargo-vendor-filterer
rust-astral-tokio-tar
uv
rust-cargo-c (Ubuntu package)
rust-cargo-c
rust-sccache
maturin
goose
rustup
rustc (Ubuntu package)
rust
rust-resctl-bench
stgit

Install security update from vendor's website.

tar-rs - update to 0.4.45
rust-scx_rustland - addressed in versions 0.0.3-8.el9, 0.0.3-8.fc42, 0.0.3-8.fc43, 0.0.3-8.fc44
rust-scx_layered - addressed in versions 0.0.6-8.el9, 0.0.6-8.fc42, 0.0.6-8.fc43, 0.0.6-8.fc44
rust-ingredients - addressed in versions 0.2.2-3.fc42, 0.2.2-3.fc43, 0.2.2-3.fc44
rust-cargo-rpmstatus - addressed in versions 0.2.4-3.fc42, 0.2.4-3.fc43, 0.2.4-3.fc44
chunkah - update to 0.3.2-1.fc43
rust-tar (Ubuntu package) - addressed in versions 0.4.26-1ubuntu0.1, 0.4.37-3ubuntu0.1, 0.4.40-1ubuntu0.1, 0.4.43-4ubuntu0.1
rust-tar - addressed in versions 0.4.45-1.el9, 0.4.45-1.el10_1, 0.4.45-1.el10_2
bpfman - update to 0.5.4-6.fc42
rust-scx_rusty - addressed in versions 0.5.4-8.el9, 0.5.4-8.fc42, 0.5.4-8.fc43, 0.5.4-8.fc44
rust-cargo-vendor-filterer - addressed in versions 0.5.18-4.el9, 0.5.18-4.el10_1, 0.5.18-4.el10_2, 0.5.18-4.el10_3, 0.5.18-4.fc42, 0.5.18-4.fc43, 0.5.18-4.fc44
rust-astral-tokio-tar - update to 0.6.0-1.el9
uv - update to 0.10.2-2.el10_2
rust-cargo-c (Ubuntu package) - update to 0.10.11-1ubuntu1.1
rust-cargo-c - addressed in versions 0.10.14-2.el10_1, 0.10.14-3.el9, 0.10.19-2.el10_2, 0.10.19-2.el10_3, 0.10.19-2.fc42, 0.10.19-2.fc43, 0.10.19-2.fc44
rust-sccache - addressed in versions 0.12.0-4.fc42, 0.13.0-4.fc43, 0.13.0-4.fc44, 0.14.0-2.fc43, 0.14.0-2.fc44
maturin - update to 1.9.6-4.el10_2
goose - addressed in versions 1.23.2-7.fc43, 1.23.2-8.fc44
rustup - addressed in versions 1.29.0-2.fc42, 1.29.0-2.fc43, 1.29.0-2.fc44, 1.29.0-2.fc45
rustc (Ubuntu package) - addressed in versions 1.31.0+dfsg1+llvm-2ubuntu1~14.04.1ubuntu1, 1.47.0+dfsg1+llvm-1ubuntu1~16.04.1ubuntu2, 1.62.1+dfsg1-1ubuntu0.22.04.3, 1.65.0+dfsg0ubuntu1~llvm2-0ubuntu0.18.04.1, 1.74.1+dfsg0ubuntu1-0ubuntu15, 1.75.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1, 1.75.0+dfsg0ubuntu1~bpo0-0ubuntu0.22.04.1, 1.75.0+dfsg0ubuntu1-0ubuntu7.4, 1.76.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1, 1.76.0+dfsg0ubuntu1~bpo0-0ubuntu0.22.04.1, 1.76.0+dfsg0ubuntu1-0ubuntu0.24.04.2, 1.77.2+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.1, 1.77.2+dfsg1ubuntu1~bpo0-0ubuntu0.22.04.1, 1.77.2+dfsg1ubuntu1-0ubuntu0.24.04.1, 1.78.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.1, 1.78.0+dfsg1ubuntu1~bpo0-0ubuntu0.22.04.1, 1.78.0+dfsg1ubuntu1-0ubuntu0.24.04.2, 1.79.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.3, 1.79.0+dfsg1ubuntu1~bpo0-0ubuntu0.22.04.1, 1.79.0+dfsg1ubuntu1-0ubuntu0.24.04.1, 1.80.1+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1, 1.80.1+dfsg0ubuntu1~bpo0-0ubuntu0.22.04.1, 1.80.1+dfsg0ubuntu1-0ubuntu0.24.04.01, 1.81.0+dfsg0ubuntu0-0ubuntu0.22.04.1, 1.81.0+dfsg0ubuntu1-0ubuntu0.24.04.1, 1.82.0+dfsg0ubuntu0~jammy-0ubuntu0.22.04.1, 1.82.0+dfsg0ubuntu0-0ubuntu0.24.04.1, 1.83.0+dfsg0ubuntu1~bpo2-0ubuntu0.24.04.1, 1.83.0+dfsg0ubuntu2~bpo2-0ubuntu2.22.04.1, 1.84.1+dfsg0ubuntu1~bpo2-0ubuntu2.24.04.1, 1.84.1+dfsg0ubuntu1~bpo10-0ubuntu4.22.04.1, 1.85.1+dfsg0ubuntu2~bpo0-0ubuntu0.24.04.2, 1.85.1+dfsg0ubuntu2~bpo0-0ubuntu1.22.04.1, 1.85.1+dfsg0ubuntu2-0ubuntu1.25.04.1, 1.88.0+dfsg0ubuntu1-0ubuntu2, 1.89.0+dfsg~24.04-0ubuntu0.22.04.2, 1.89.0+dfsg~24.04-0ubuntu0.24.04.2, 1.91.1+dfsg~22.04-0ubuntu0.22.04.3, 1.91.1+dfsg~24.04-0ubuntu0.24.04.2
rust - addressed in versions 1.94.1-1.fc42, 1.94.1-1.fc43, 1.94.1-1.fc44
rust-resctl-bench - addressed in versions 2.2.5-12.el9, 2.2.5-12.fc42, 2.2.5-12.fc43, 2.2.5-12.fc44
stgit - addressed in versions 2.5.5-5.fc42, 2.5.5-5.fc43, 2.5.5-5.fc44

• https://github.com/alexcrichton/tar-rs/security/advisories/GHSA-j4xf-2g29-59ph
• https://github.com/advisories/GHSA-j4xf-2g29-59ph
• https://github.com/composefs/tar-rs/security/advisories/GHSA-j4xf-2g29-59ph

• Multiple vulnerabilities in tar-rs
• Fedora EPEL 10.1 update for rust-tar
• Fedora EPEL 10.2 update for maturin, rust-tar, uv
• Fedora EPEL 9 update for rust-astral-tokio-tar, rust-tar
• Fedora 45 update for rustup
• Fedora 44 update for rustup
• Fedora 44 update for stgit
• Fedora 43 update for rustup
• Fedora 43 update for stgit
• Fedora 44 update for rust-cargo-rpmstatus
• Fedora 42 update for rustup
• Fedora 42 update for stgit
• Fedora 44 update for rust-cargo-c
• Fedora 43 update for rust-cargo-rpmstatus
• Fedora 44 update for rust-cargo-vendor-filterer
• Fedora 43 update for rust-cargo-c
• Fedora 42 update for rust-cargo-rpmstatus
• Fedora 43 update for rust-cargo-vendor-filterer
• Fedora 42 update for rust-cargo-vendor-filterer
• Fedora EPEL 10.3 update for rust-cargo-vendor-filterer
• Fedora 44 update for rust-ingredients
• Fedora 44 update for rust-sccache
• Fedora 42 update for rust-cargo-c
• Fedora 43 update for chunkah
• Fedora 43 update for rust-resctl-bench
• Fedora 44 update for rust-resctl-bench
• Fedora 42 update for rust-resctl-bench
• Fedora EPEL 9 update for rust-resctl-bench
• Fedora EPEL 10.2 update for rust-cargo-vendor-filterer
• Fedora 43 update for rust-ingredients
• Fedora EPEL 10.3 update for rust-cargo-c
• Fedora EPEL 10.2 update for rust-cargo-c
• Fedora 42 update for rust-ingredients
• Fedora EPEL 10.1 update for rust-cargo-vendor-filterer
• Fedora 43 update for rust-sccache
• Fedora EPEL 10.1 update for rust-cargo-c
• Fedora EPEL 9 update for rust-cargo-vendor-filterer
• Fedora 44 update for rust-scx_layered
• Fedora 44 update for rust-scx_rustland
• Fedora 44 update for rust-scx_rusty
• Fedora EPEL 9 update for rust-cargo-c
• Fedora 43 update for rust-scx_layered
• Fedora 43 update for rust-scx_rustland
• Fedora 43 update for rust-scx_rusty
• Fedora 42 update for rust-scx_rusty
• Fedora 42 update for rust-scx_rustland
• Fedora 42 update for rust-scx_layered
• Fedora 42 update for rust-sccache
• Fedora EPEL 9 update for rust-scx_layered
• Fedora EPEL 9 update for rust-scx_rustland
• Fedora EPEL 9 update for rust-scx_rusty
• Fedora 42 update for bpfman
• Fedora 44 update for rust-sccache
• Fedora 43 update for rust-sccache
• Fedora 44 update for rust
• Fedora 43 update for rust
• Fedora 42 update for rust
• Fedora 43 update for goose
• Fedora 44 update for goose
• Ubuntu update for rust-cargo-c
• Ubuntu update for rust-tar
• Ubuntu update for rustc
• Ubuntu update for rust-tar
• Ubuntu update for rustc