CVE-2026-70622 tar-rs 0.4.11 - 0.4.46 Symlink Escape via append_dir_all()
Attackers can read files outside the intended directory by planting symlinks when a privileged process archives an untrusted directory using tar-rs.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-70622?
CVE-2026-70622 is a high-severity path traversal vulnerability in composefs tar-rs, published on 10 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder::append_dir_all() function that allows attackers to read files outside the intended source root directory by planting symlinks in an attacker-controlled directory. When a privileged process archives an untrusted directory, the function follows symlinks without verifying that resolved targets remain within the source root, causing out-of-bounds files to be included in the archive as regular files and disclosed to the attacker.
Weakness: CWE-59
Which versions are affected by CVE-2026-70622?
How do I fix CVE-2026-70622?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-70622 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-70622 exists.
Sources
Also known as AZL-95589, AZL-95592, AZL-95604, AZL-95607, AZL-95625, AZL-95628 and 5 more.