CVE-2026-33056: Tar_project Tar Privilege Escalation Bug

CVE-2026-33056 Overview

CVE-2026-33056 is a symlink attack vulnerability affecting the tar-rs library, a popular tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root.

Critical Impact

Attackers can craft malicious tar archives that, when extracted, modify permissions on arbitrary directories outside the intended extraction path, potentially enabling further exploitation or privilege escalation.

Affected Products

• tar-rs versions 0.4.44 and below
• Rust applications using the vulnerable tar crate for archive extraction
• Systems processing untrusted tar archives with affected library versions

Discovery Timeline

• March 20, 2026 - CVE-2026-33056 published to NVD
• March 24, 2026 - Last updated in NVD database

Technical Details for CVE-2026-33056

Vulnerability Analysis

This vulnerability represents a classic Time-of-Check Time-of-Use (TOCTOU) race condition combined with improper symlink handling (CWE-61). The core issue lies in the unpack_dir function's use of fs::metadata() for path validation. Unlike fs::symlink_metadata(), the fs::metadata() function follows symbolic links to retrieve metadata about the target rather than the link itself.

When processing archive entries, the function checks if a destination path already exists and is a directory. An attacker can exploit this by crafting a malicious tarball with two carefully ordered entries: first, a symbolic link pointing to a sensitive directory outside the extraction root (such as /etc), and second, a directory entry with the same name as the symlink. When the crate processes the directory entry, the metadata check follows the symlink and confirms the target is indeed a directory. The subsequent chmod operation is then incorrectly applied to the symlink's target rather than the intended extraction path.

Root Cause

The root cause is the inappropriate use of fs::metadata() instead of fs::symlink_metadata() when validating path types during archive extraction. The fs::metadata() function inherently follows symbolic links, creating a path confusion vulnerability where the validation check operates on one path (the symlink target) while the intended operation should apply to another (the extraction destination).

Attack Vector

The attack vector is network-based, requiring user interaction to download and extract a maliciously crafted tar archive. An attacker would:

1. Create a tar archive containing a symbolic link entry pointing to a target directory outside the extraction root
2. Include a subsequent directory entry with the same name as the symlink
3. Distribute the malicious archive to potential victims
4. When a victim extracts the archive using a vulnerable version of tar-rs, the symlink target's permissions are modified

The vulnerability allows permission modification on arbitrary directories, potentially weakening security controls on critical system directories.

Detection Methods for CVE-2026-33056

Indicators of Compromise

• Unexpected permission changes on system directories, particularly those outside application-controlled paths
• Tar archives containing symbolic links immediately followed by directory entries with identical names
• Log entries showing chmod operations on sensitive directories like /etc, /var, or other system paths during archive extraction
• Application behavior indicating path traversal through symlinks during tar extraction operations

Detection Strategies

• Implement file integrity monitoring (FIM) on critical system directories to detect unauthorized permission modifications
• Monitor archive extraction operations for suspicious symlink patterns, particularly those targeting paths outside extraction roots
• Use static analysis tools to identify applications using vulnerable tar-rs versions (0.4.44 and below)
• Deploy dependency scanning in CI/CD pipelines to flag vulnerable crate versions before deployment

Monitoring Recommendations

• Enable audit logging for chmod system calls, particularly those affecting system-critical directories
• Monitor for applications processing tar archives from untrusted sources
• Track dependency versions across Rust projects using cargo audit or similar vulnerability scanning tools
• Implement anomaly detection for permission changes on directories that should have stable configurations

How to Mitigate CVE-2026-33056

Immediate Actions Required

• Upgrade the tar-rs crate to version 0.4.45 or later, which contains the security fix
• Audit applications that process tar archives from untrusted sources for vulnerable dependency versions
• Review permission configurations on critical system directories to detect any unauthorized modifications
• Consider implementing additional symlink validation before archive extraction as a defense-in-depth measure

Patch Information

The vulnerability has been fixed in tar-rs version 0.4.45. The fix is available in commit 17b1fd84e632071cb8eef9d3709bf347bd266446. For detailed information about the vulnerability and remediation, refer to the GitHub Security Advisory GHSA-j4xf-2g29-59ph.

To update the dependency in your Rust project, modify your Cargo.toml to require the patched version:

[dependencies]
tar = ">=0.4.45"

Workarounds

• Avoid processing tar archives from untrusted sources until the patch is applied
• Implement pre-extraction validation to detect and reject archives containing suspicious symlink patterns
• Run archive extraction operations in sandboxed environments with restricted filesystem access
• Use containerization or chroot environments to limit the impact of potential exploitation

# Verify tar-rs version in your Rust project
cargo tree -p tar

# Update to patched version
cargo update -p tar

# Run cargo audit to check for known vulnerabilities
cargo audit