CVE-2026-70622: tar-rs Information Disclosure Vulnerability

CVE-2026-70622 Overview

CVE-2026-70622 is a symlink escape vulnerability in the tar-rs Rust crate, affecting versions 0.4.11 through 0.4.46. The flaw resides in the Builder::append_dir_all() function, which follows symbolic links without verifying that resolved targets stay within the source root directory. An attacker who controls a directory being archived by a privileged process can plant symlinks that redirect the archiver to sensitive files outside the intended scope. Those out-of-bounds files are then embedded in the resulting archive as regular files and exposed to the attacker. The issue is classified under CWE-59: Link Following.

Critical Impact
Attackers can exfiltrate arbitrary files readable by the archiving process, including credentials, keys, and configuration secrets outside the source root.

Affected Products

tar-rs crate version 0.4.11 (Rust)
tar-rs crate versions 0.4.12 through 0.4.45 (Rust)
tar-rs crate version 0.4.46 (Rust)

Discovery Timeline

2026-08-10 - CVE-2026-70622 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-70622

Vulnerability Analysis

The tar-rs crate provides Rust bindings for building and reading tar archives. Its Builder::append_dir_all() API recursively walks a source directory and appends every entry to the archive. The vulnerable implementations resolve symbolic links encountered during traversal without confirming that the link target remains inside the caller-supplied source root.

When a privileged workflow archives a directory whose contents an unprivileged user can modify, that user can plant symlinks pointing at arbitrary filesystem paths. The archiver dereferences those symlinks, reads the target files with the caller's privileges, and stores the contents in the tarball as normal file entries. The attacker then retrieves the archive and reads data they could not otherwise access.

Because the archive contains the actual file bytes rather than symlink metadata, victims cannot detect the escape by inspecting link records. The confidentiality impact is scoped to files readable by the process running append_dir_all(), but that process is often a build agent, backup daemon, or container tool with broad read permissions.

Root Cause

The root cause is missing containment enforcement during recursive traversal. append_dir_all() uses metadata that follows symlinks and does not compare the canonicalized target path against the canonicalized source root before reading a file.

Attack Vector

Exploitation requires the attacker to write into a directory that a higher-privileged process later archives. The attacker replaces or adds entries with symlinks such as secret -> /etc/shadow or key -> /root/.ssh/id_rsa, then waits for the archive to be produced and delivered. See the VulnCheck Security Advisory and the GitHub Gist Code Snippet for a demonstration.

Detection Methods for CVE-2026-70622

Indicators of Compromise

Tar archives produced by build, backup, or export jobs that contain files with paths matching sensitive host locations such as /etc/, /root/, or ~/.ssh/.
Symlinks inside user-writable staging directories whose targets resolve outside the intended source root.
Privileged processes linked against tar-rs versions between 0.4.11 and 0.4.46 opening files far from their working directory.

Detection Strategies

Inventory Rust binaries and container images for tar-rs in the vulnerable range using SBOM tooling such as cargo audit or syft.
Instrument archiving jobs to log every file path read during append_dir_all() and alert when a resolved path leaves the declared source root.
Compare archive manifests against expected file listings to flag unexpected system paths appearing as regular entries.

Monitoring Recommendations

Enable filesystem auditing (auditd, eBPF, or EDR file telemetry) on privileged accounts that run backup or archive tasks and alert on reads of sensitive files from those PIDs.
Track symlink creation events in shared or user-writable directories that feed into archiving pipelines.
Review CI/CD artifact stores for archives containing paths that do not originate from the declared workspace.

How to Mitigate CVE-2026-70622

Immediate Actions Required

Upgrade tar-rs to a fixed release beyond 0.4.46 in every Rust project and rebuild dependent binaries and container images.
Audit privileged services that archive untrusted directories and rotate any secrets that may have been exposed through affected pipelines.
Restrict write access to directories consumed by append_dir_all() so untrusted users cannot introduce symlinks.

Patch Information

Refer to the VulnCheck Security Advisory for fixed version guidance. Update the tar dependency in Cargo.toml to a patched release, run cargo update -p tar, and redeploy all binaries built against the vulnerable range.

Workarounds

Run archiving processes under a least-privilege account that cannot read sensitive files outside the intended source root.
Pre-scan the source directory and reject or strip any symlinks whose canonicalized targets fall outside the source root before invoking append_dir_all().
Replace append_dir_all() with a custom walker that opens entries with O_NOFOLLOW semantics and validates each resolved path against the source root.

bash

# Update the tar-rs dependency to a fixed release
cargo update -p tar
cargo audit