Path traversal in ocaml-tar allows arbitrary file write (CVE-2026-45390)

A path traversal vulnerability in ocaml-tar allows a maliciously crafted archive containing `../` path segments to escape the intended extraction directory. The `Tar_unix.extract` function passes unsanitized filenames to `Filename.concat`, which does not strip traversal sequences before they are passed to `Unix.openfile`. An attacker who can supply a crafted archive to a tar decompression endpoint can write files to arbitrary locations on the filesystem outside the intended destination. Affected versions: - 0.3.0 - 0.8.0 - 0.9.0 - 1.0.0 - 1.0.1 - 1.1.0 - 2.0.0 - 2.0.1 - 2.1.0 - 2.2.0 - 2.2.1 - 2.2.2 - 2.3.0 - 2.4.0 - 2.5.0 - 2.5.1 - 2.6.0 - 3.0.0 - 3.1.1 - 3.1.2 - 3.2.0 - 3.3.0 - v3.4.0 - v3.3.0 - v3.1.1 - V3.1.0 - v2.4.0 - v2.3.0 - v2.2.2 - v2.2.1 - v2.2.0 - v2.0.0 - v1.1.0 - v1.0.1 - v1.0.0 - v0.9.0 - v0.8.0 - v0.7.1 - v0.7.0 - v0.6.1 - v0.6.0 - v0.5.1 - v0.5.0 - v0.4.2 - v0.4.1 - v0.4.0 We recommend updating to: 3.5.0. CVSS 9.1 · our assessment: act_now Reference: https://osv.dev/vulnerability/OSEC-2026-08 Details: https://vuln.today/cve/CVE-2026-45390