CVE-2026-70622: tar-rs symlink escape leading to privileged file disclosure

Vulnerability Overview CVE-2026-70622 - tar-rs Symlink Escape Leading to Privileged File Leakage Issue Description: follows symbolic links by default ( ). While this behavior is documented, the security issue is that the symbolic link target being dereferenced is not validated against the source root directory passed to . Core Problem: The function uses as the logical archive boundary for constructing archive entry names, but when reading from the file system, it follows symbolic links via , , , and without verifying that the resolved target still resides within . Impact: An attacker can control symbolic links within the archive directory, pointing them to content outside that directory. The resulting archive file will include the target content as regular files. If the archiver runs with higher privileges than the attacker, this leads to confusion deputy/privileged file leakage issues. Affected Versions Affected Versions: 0.4.11 through 0.4.40 (inclusive) Fixed Versions: None Current Main Branch: Still affected (as of commit ) Remediation Temporary Solution: Callers should disable symbolic link following when archiving untrusted trees: With , symbolic links are stored as symlink entries rather than being dereferenced and embedded as regular files. Proof of Concept (POC) Code Scenario Privileged Archiver Result Directory Symbolic Links Also Work Related Code

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-70622: tar-rs symlink escape leading to privileged file disclosure