CVE-2026-5223 Crates in third party registries can override the cached source of other crates

What is CVE-2026-5223?

CVE-2026-5223 is a medium-severity path traversal vulnerability in Rust Project Cargo, published on 25 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry. The severity of the vulnerability is **medium** for users of third-party registries. Users of crates.io are **not affected**, as crates.io forbids uploading crates containing any symlink.

Weakness: CWE-61

Which versions are affected by CVE-2026-5223?

2 open source packages ship an affected version, including cargo. It affects 1 product.

Products include Rust-Lang Cargo.

How do I fix CVE-2026-5223?

Upgrade cargo to 0.97.0 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-5223 being exploited?

There is no known exploitation of CVE-2026-5223 in the wild and no public exploit code.

Other vulnerabilities in Rust Project Cargo

• CVE-2022-46176 Cargo did not verify SSH host keys Medium 5.3
• CVE-2022-36114 Extracting malicious crates can fill the file system Medium 4.8
• CVE-2022-36113 Extracting malicious crates can corrupt arbitrary files Medium 4.6
• CVE-2026-5222 Cargo can be coerced to share credentials between registries Low 2.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2026-5223, AZL-88272, AZL-88278, BELL-CVE-2026-5223, DEBIAN-CVE-2026-5223, GHSA-jq42-7mfv-hm57 and 2 more.