tar-rs CVE-2026-70622

Exploitation requires two specific conditions to be met simultaneously. First, the attacker must be able to write or plant symbolic links inside a directory that will subsequently be archived - this can occur via filesystem write access to a shared or upload directory, or by supplying the directory contents through any mechanism that does not strip or validate symlinks before storage (e.g., tar extraction, rsync, or a file upload endpoint). Second, a process with elevated operating-system privileges must call Builder::append_dir_all() from tar-rs on that attacker-influenced directory; the privilege level of the archiving process directly determines the sensitivity of files accessible via escaped symlinks, with root-level archivers exposing the entire filesystem. Applications that archive only directories under their own exclusive write control and never expose directory-write access to external actors are not affected. The non-default condition is the combination of externally-writable directory plus privileged archival - neither alone is sufficient.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) scores 7.1, reflecting network-reachable exploitation with low complexity and high confidentiality impact against the vulnerable system, with no integrity or availability impact. Real-world risk is conditional on a specific architectural pattern - a privileged process archiving an attacker-influenced directory - but that pattern is common in upload pipelines, build systems, container image processors, and backup tooling written in Rust. A publicly available proof-of-concept lowers the exploitation bar substantially, and even a mid-sized municipal IT team in tczew running a self-hosted Rust-based CI pipeline or artifact service that processes untrusted user submissions should treat this as urgent given POC availability. No EPSS data was present in the input, and the CVE is not yet listed in CISA KEV, indicating no confirmed mass exploitation at time of analysis. The CVSS 4.0 score appears consistent with the described behavior: the low privilege requirement reflects the need to plant symlinks in the target directory, not full system access. The absence of integrity and availability impact is accurate - this is a pure information-disclosure vulnerability. There is no conflicting signal between the CVSS vector and the description.

An attacker uploads a directory containing a crafted symbolic link - for example, a file named secret.txt pointing to /etc/shadow or a private TLS key - to a location that a privileged Rust service will archive using Builder::append_dir_all(). The service creates the tar archive without detecting the symlink escape, and the sensitive file's contents are embedded as a regular archive entry. The attacker downloads or otherwise retrieves the resulting archive and extracts the sensitive file contents. A public proof-of-concept demonstrating this technique is available at https://gist.github.com/thesmartshadow/e7dac0bb690ee17b9cc142154cb11726.