Red Hat CVE-2026-33056

The tar-rs library is a Rust crate for reading and writing tar archive formats. The vulnerability exists in the unpack_dir function, which uses fs::metadata() to validate whether a path already exists and determine if it is a directory. Because fs::metadata() in Rust follows symbolic links by design (unlike lstat), an attacker can exploit this behavior by placing a symlink entry in the tarball that points outside the extraction root, followed by a directory entry with the same name. When the function checks if the path is a directory, it resolves the symlink target and sees a directory there, then proceeds to apply filesystem operations (chmod) to that external location. This represents a classic instance of CWE-61 (Unix Symbolic Link Following), where inadequate validation of symlink targets allows arbitrary file system operations outside intended boundaries.