6.5

CVE-2026-33056: alexcrichton tar-rs UNIX Symbolic Link (Symlink) Following

CVSS: 6.5v3.1MediumAnalyzed
AliasesALPINE-CVE-2026-33056UBUNTU-CVE-2026-33056USN-8138-1
Published 20-03-2026Last modified 20-03-2026
Open JSON

Vulnerability summary

CVE-2026-33056 is a medium (CVSS 6.5) UNIX Symbolic Link (Symlink) Following vulnerability in alexcrichton tar-rs. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 31% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
36/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.39%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 0 · Related 1
CGA-8XVQ-X5FF-4HPP

Timeline

  1. 20-03-2026
    PublishedVulnerability first disclosed.
  2. 20-03-2026
    Last modifiedVulnerability information updated.

Description

tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45.

CVSS metrics

10 scores · 8 sources · 2 versions

EPSS trend

Probability

0.39%

Chance of exploitation in the next 30 days

Percentile

31%

Versus all other CVEs

30-day change

+0.01 pp

From 0.38% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.39%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • githubUnverified

    Tar Rs

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Ubuntu21 products
  • cargoAll versions (No fix recorded)
  • rust-astral-tokio-tarAll versions (No fix recorded)
  • rust-async-tarAll versions (No fix recorded)
  • rust-cargo-cAll versions (No fix recorded) | < 0.10.11-1ubuntu1.1
  • rust-tar< 0.4.26-1ubuntu0.1 | All versions (No fix recorded) | < 0.4.37-3ubuntu0.1 | < 0.4.40-1ubuntu0.1 | < 0.4.43-4ubuntu0.1
Chainguard15 products
  • bootc-binary< 1.10.0-r3
  • buck2< 20260315-r4
  • cargo-c< 0.10.21-r3
  • deno< 2.7.8-r0
  • fnm< 1.39.0-r2
Wolfi11 products
  • buck2< 20260315-r4
  • cargo-c< 0.10.21-r3
  • deno< 2.7.8-r0
  • pixi< 0.66.0-r3
  • qdrant< 1.17.0-r7
Debian2 products
  • rust-tarAll versions (No fix recorded) | < 0.4.45-1
  • rustcAll versions (No fix recorded) | < 1.85.1+dfsg1-1+deb13u1 | < 1.92.0+dfsg1-2
Alexcrichton1 product
Alpine1 product
  • rust< 1.78.0-r1 | < 1.83.0-r1 | < 1.87.0-r1 | < 1.91.1-r1 | < 1.94.0-r1
Crates.Io1 product
  • tar< 0.4.45 | ≥ 0.0.0-0, < 0.4.45
Tar_project1 product

8 vendors · 53 products

References

15 links
Show all 15 references