CVE-2026-45390 Overview
CVE-2026-45390 is a path traversal vulnerability [CWE-22] in the OCaml-tar library before version 3.4.0. The library fails to sanitize ../ path segments in archive entry names during decompression. An attacker who controls a tar archive processed by a vulnerable endpoint can write files outside the intended extraction directory. The standard tar(1) utility rejects such archives, but ocaml-tar extracts them without restriction. The flaw enables arbitrary file writes on hosts that expose tar decompression functionality to untrusted input.
Critical Impact
Remote attackers can write arbitrary files outside the extraction directory, potentially overwriting application binaries, configuration files, or system resources to achieve code execution or persistence.
Affected Products
- OCaml-tar library versions before 3.4.0
- Applications and services that use OCaml-tar to decompress untrusted tar archives
- OCaml ecosystem packages that depend on the vulnerable ocaml-tar releases
Discovery Timeline
- 2026-06-15 - CVE-2026-45390 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-45390
Vulnerability Analysis
The vulnerability resides in the archive extraction routines of ocaml-tar prior to version 3.4.0. When the library reads tar entry headers, it uses the name field to construct the destination path on disk. The extraction logic does not validate or normalize path components against directory traversal sequences. An entry whose name contains ../ traverses parent directories relative to the extraction root.
This behavior diverges from the GNU tar(1) reference implementation, which refuses to extract entries containing parent-directory references by default. Because ocaml-tar performs the write regardless, callers that treat the library as a drop-in tar reader inherit the unsafe behavior. The result is an arbitrary file write primitive scoped to the privileges of the extracting process.
Root Cause
The root cause is missing input validation on tar entry filenames before file creation. The library trusts archive-supplied paths and concatenates them to the destination directory without canonicalization or boundary enforcement. There is no check that the resolved absolute path remains within the intended extraction root.
Attack Vector
An attacker delivers a crafted tar archive to any application endpoint that decompresses tar input using ocaml-tar. Typical exposure surfaces include package managers, CI/CD build artifacts, file upload handlers, container image processors, and backup restore workflows. Upon extraction, files within the archive are written to attacker-chosen paths such as ../../etc/cron.d/payload or ../../home/user/.ssh/authorized_keys. The exploit requires no authentication or user interaction when the endpoint is reachable over the network.
No public proof-of-concept code is referenced in the advisory. See the OSV Vulnerability Report OSEC-2026-08 for technical details.
Detection Methods for CVE-2026-45390
Indicators of Compromise
- Files appearing outside expected extraction directories with timestamps matching archive processing events
- Modified system files (/etc/cron.d/*, ~/.ssh/authorized_keys, service unit files) following tar decompression activity
- Application logs showing successful extraction of archives containing entries with .. in the path
- Unexpected write operations by processes linked against ocaml-tar to paths outside their working directory
Detection Strategies
- Inventory all OCaml applications and OPAM packages that declare a dependency on ocaml-tar and identify versions below 3.4.0
- Inspect archive content before extraction by listing entries and flagging any name containing ../ or absolute path prefixes
- Add file integrity monitoring on sensitive directories that could be targeted by traversal payloads
- Review web application and API logs for tar uploads followed by file writes outside the designated upload sandbox
Monitoring Recommendations
- Alert on filesystem writes by tar-processing services to paths outside their configured working directories
- Monitor process execution chains where ocaml-tar-linked binaries are followed by changes to authentication or scheduled task files
- Track inbound archives by size and entry count and sample suspicious uploads for offline analysis
How to Mitigate CVE-2026-45390
Immediate Actions Required
- Upgrade ocaml-tar to version 3.4.0 or later across all affected applications and rebuild dependent binaries
- Audit recent extraction logs for archives containing traversal sequences and investigate any resulting file writes
- Restrict network access to endpoints that accept tar uploads until patching is complete
- Run extraction processes under least-privilege accounts with restricted filesystem scope using chroot, containers, or seccomp
Patch Information
The maintainers fixed the issue in ocaml-tar version 3.4.0 by enforcing path validation during extraction. Update via OPAM with opam update && opam upgrade tar and verify the installed version is 3.4.0 or higher. Refer to the OSV Vulnerability Report OSEC-2026-08 for full remediation guidance.
Workarounds
- Pre-validate archives by rejecting any entry whose name contains .., leading /, or resolves outside the extraction root
- Wrap extraction calls with a path canonicalization check that compares the resolved path against the intended base directory
- Execute tar decompression in an ephemeral sandbox such as a disposable container or jail with no write access to host paths
# Configuration example: verify ocaml-tar version after upgrade
opam list tar
opam upgrade tar
opam show tar | grep version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
