CVE-2026-5223: Cargo Path Traversal Vulnerability

CVE-2026-5223 Overview

CVE-2026-5223 is a symlink handling flaw in Cargo, the Rust package manager. Cargo incorrectly processes symbolic links contained inside crate tarballs downloaded from third-party registries. A malicious crate can use a crafted symlink to override the source code of another crate hosted on the same registry. The issue is classified under [CWE-61] (UNIX Symbolic Link Following).

Users of the official crates.io registry are not affected, because crates.io rejects any uploaded crate that contains a symlink. The vulnerability impacts developers who consume crates from alternative or self-hosted registries.

Critical Impact
A malicious crate can silently replace the contents of a trusted crate from the same third-party registry, leading to supply-chain compromise of downstream Rust builds.

Affected Products

Rust Cargo package manager (versions prior to the fix in pull request #17031)
Rust toolchain distributions bundling vulnerable Cargo releases
Projects consuming crates from third-party or self-hosted Cargo registries

Discovery Timeline

2026-05-25 - CVE-2026-5223 published to NVD and disclosed in the Rust Blog
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-5223

Vulnerability Analysis

Cargo downloads crates as gzipped tarballs and extracts them into a local cache before compilation. The extraction routine did not correctly validate symbolic links contained inside the tarball. A crate could ship a symlink that points outside its own extraction directory, into the cache path of a different crate from the same registry.

When Cargo later resolved dependencies, it would read source files through that symlink. The compiler then ingested attacker-controlled Rust code while the developer believed they were building the legitimate crate. The flaw affects the integrity of dependencies but does not directly expose confidentiality, which aligns with the medium severity rating.

Root Cause

The root cause is missing validation of symlink targets during crate extraction. Cargo treated symlinks inside tarballs as normal file entries and wrote them verbatim to disk. Because all crates from a registry share a common cache root, a symlink with a relative path could traverse into a sibling crate directory and replace its files on the next access.

Attack Vector

An attacker publishes a malicious crate to a third-party registry that also hosts a target crate. The malicious crate contains a tarball entry that is a symlink pointing at the on-disk location of the target crate within Cargo's cache. A developer who depends on both crates, or who installs the malicious crate first, will have the target crate's source overridden. Subsequent cargo build invocations compile attacker-controlled code with the privileges of the developer or build agent. User interaction is required to add or update the malicious dependency.

No verified public proof-of-concept code is available. Refer to the GitHub pull request #17031 for the corrected extraction logic.

Detection Methods for CVE-2026-5223

Indicators of Compromise

Symbolic links present inside the Cargo registry cache directory, typically under ~/.cargo/registry/src/, that resolve to paths outside their own crate folder.
Unexpected modification times on cached crate source files that do not correspond to a recent cargo update or cargo fetch.
Build outputs that differ between identical Cargo.lock files on clean and previously used machines.

Detection Strategies

Audit third-party registry mirrors for any uploaded crate tarballs that contain symlink entries by inspecting the tar headers.
Compare the SHA-256 of locally extracted crate sources against the .cargo-checksum.json manifest shipped with each crate.
Scan CI build agents for cross-crate symlinks within the Cargo cache after dependency resolution.

Monitoring Recommendations

Log all cargo install, cargo fetch, and cargo build commands on shared build infrastructure and correlate them with registry sources.
Monitor file integrity on developer workstations and CI runners for writes into ~/.cargo/registry/src/ originating from tar extraction.
Alert on any third-party registry that begins serving crates containing symlinks, since this should be uncommon.

How to Mitigate CVE-2026-5223

Immediate Actions Required

Update Cargo and the Rust toolchain to a release that includes the fix from pull request #17031.
Purge the local Cargo registry cache with cargo cache clean or by deleting ~/.cargo/registry/src/ and ~/.cargo/registry/cache/ on developer and CI systems.
Restrict the list of permitted registries in .cargo/config.toml to trusted sources only.

Patch Information

The Rust project corrected the symlink handling in Cargo through pull request #17031. The patched Cargo refuses to extract symlinks that resolve outside the crate's own directory. Full details are published in the Rust security announcement and the Rust Blog post for CVE-2026-5223.

Workarounds

Consume crates exclusively from crates.io, which rejects uploads containing symlinks, until all build hosts are patched.
Operate self-hosted registries with an upload policy that rejects tarballs containing symlink entries.
Pin dependencies with Cargo.lock and review new third-party crates before adoption to limit exposure to malicious uploads.

bash

# Configuration example: restrict Cargo to crates.io and clear the cache
cat > ~/.cargo/config.toml <<'EOF'
[source.crates-io]
replace-with = "crates-io"

[registries]
# Remove or comment out untrusted third-party registries
EOF

rm -rf ~/.cargo/registry/src ~/.cargo/registry/cache
rustup update stable
cargo --version