RUSTSEC-2026-0328 `decompress`: tar-family extractors write archive entries without a path-traversal check (tar-slip)
A malicious tar archive can write files outside the destination directory, potentially leading to arbitrary file overwrite or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is RUSTSEC-2026-0328?
RUSTSEC-2026-0328 is a path traversal vulnerability in decompress, published on 19 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The tar-family extractors in decompress (.tar, .tar.gz, .tar.xz,
.tar.bz2, .tar.zst) build each output path from the raw archive entry path
and write to it with no traversal check, so a malicious archive can write files
outside the destination directory, a "tar-slip" / zip-slip path traversal
(CWE-22 / CWE-23).
In src/decompressors/tar_common.rs (tar_extract):
let filepath = entry.path()?; // raw entry path
let filepath = filepath.components().skip(opts.strip).collect::<PathBuf>();
// strips leading components only — keeps `..`
let outpath = to.join(filepath);
// ...
let mut outfile = fs::File::create(&outpath)?; // writes anywhere
.components().skip(opts.strip) removes a fixed number of leading path
components but leaves interior .. components intact so an entry named
e.g. ../../../../home/<user>/.bashrc, or an absolute path, resolves outside
to. This affects all platforms.
Which versions are affected by RUSTSEC-2026-0328?
1 open source package ship an affected version, including decompress.
| Package | Affected | Fixed in |
|---|---|---|
decompress crates.io | From 0.0.0-0 | None |
How do I fix RUSTSEC-2026-0328?
No fix has been published for RUSTSEC-2026-0328 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is RUSTSEC-2026-0328 being exploited?
There is no known exploitation of RUSTSEC-2026-0328 in the wild and no public exploit code.