{"id":"RUSTSEC-2026-0113","aliases":["GHSA-xx64-wwv2-hcqq"],"title":"`unpack_in` can chmod arbitrary directories by following symlinks","summary":"`unpack_in` can chmod arbitrary directories by following symlinks","severity":"none","vendor":"astral-tokio-tar","product":"astral-tokio-tar","ecosystem":"rust","affected":["astral-tokio-tar >= 0.0.0-0, < 0.6.1"],"patched":["astral-tokio-tar 0.6.1"],"published":"2026-04-27","updated":"2026-10-12","sourceUpdated":"2026-10-12T18:00:09.237324844Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0113","references":[{"url":"https://crates.io/crates/astral-tokio-tar"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0113.html"},{"url":"https://github.com/astral-sh/tokio-tar/commit/f1fa37043a6fe798dcd1fd4b3000d889ac35b183"}],"tags":["osv","rust"],"ingestedAt":"2026-10-13T11:45:30.190Z","slug":"RUSTSEC-2026-0113","body":"## Overview\n\nIn versions 0.6.0 and earlier of astral-tokio-tar, the unpack_in API could\ninadvertently modify the permissions of external (i.e. non-archive) directories\noutside of the archive. An attacker could use this to contrite a tar archive\nthat maliciously changes directory permissions outside of its intended\nhierarchy. This flaw only affects directories; individual file permissions\ncannot be modified via it.\n\nSee GHSA-j4xf-2g29-59ph for the equivalent flaw in the tar crate.\n\n## Affected packages\n\n- `astral-tokio-tar >= 0.0.0-0, < 0.6.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `astral-tokio-tar 0.6.1`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}