astral-tokio-tar: `unpack_in` can chmod arbitrary directories by following symlinks
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
### Impact In versions 0.6.0 and earlier of astral-tokio-tar, the `unpack_in` API could inadvertently modify the permissions of external (i.e. non-archive) directories outside of the archive. An attacker could use this to contrite a tar archive that maliciously changes directory permissions outside of its intended hierarchy. This flaw only affects directories; individual file permissions cannot be modified via it. See GHSA-j4xf-2g29-59ph for the equivalent flaw in the `tar` crate. ### Patches Versions 0.6.1 and newer of astral-tokio-tar use `fs::symlink_metdata` rather than `fs::metadata`, avoiding the traversal. ### Workarounds Users are advised to upgrade to version 0.6.1 or newer to address this advisory. Users should experience no breaking changes as a result of the patch above. ### Resources - GHSA-j4xf-2g29-59ph for the original `tar` vulnerability ### Attribution - Reporter: Adam Harvey (@lawngnome)
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | astral-tokio-tar (crates.io) | before 0.6.1 | 0.6.1 | Patch available | GHSA-xx64-wwv2-hcqq |
- astral-tokio-tar (crates.io) Vendor— Affected before 0.6.1 Fixed in 0.6.1 Patch available GHSA-xx64-wwv2-hcqq
Remediation
- Fix · GHSA-xx64-wwv2-hcqq astral-tokio-tar (crates.io) Fixed in 0.6.1 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-xx64-wwv2-hcqq
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences