Tar EUVD-2026-13616

The CVSS v4.0 score of 5.1 reflects a medium severity rating with network attack vector and low attack complexity, but zero privileges required and no user interaction required. However, the actual exploitability is constrained by the fact that an attacker must induce a user to unpack a specifically crafted tarball, which introduces a minor but real friction point. The vulnerability has a narrow scope—it only affects directory permissions (chmod), not data integrity or confidentiality—limiting the immediate impact despite network accessibility. No KEV status or EPSS probability data is provided in the intelligence sources, but the availability of a public GitHub security advisory and confirmed patch (version 0.4.45) suggest the issue is known in the wild. The real-world risk is moderate: while the attack requires user interaction (selecting a tarball to unpack), the consequence of arbitrary directory permission modification could enable privilege escalation or access control bypass in downstream applications that rely on file permissions for security boundaries.

An attacker creates a malicious tarball with a symlink entry (e.g., 'data' -> '/etc') followed by a directory entry also named 'data'. When a user or automated system unpacks this tarball using a vulnerable version of tar-rs, the library checks if 'data' exists and is a directory; it resolves the symlink and sees /etc is indeed a directory, then applies chmod operations to /etc instead of the intended extraction directory. This could weaken permission protections on critical system directories, potentially enabling the attacker or other local users to gain unauthorized access or modify system configurations. No public proof-of-concept is explicitly referenced in the intelligence sources, but the detailed CVE description and public patch suggest the issue is straightforward to reproduce by craft a tarball with the described structure.