AZL-95631
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-95631.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-95631
- Upstream
- Published
- 2026-08-10T18:18:50Z
- Modified
- 2026-09-21T05:34:22Z
- Summary
- CVE-2026-70622 affecting package rust for versions less than 1.96.0-1
- Details
-
tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder::append_dir_all() function that allows attackers to read files outside the intended source root directory by planting symlinks in an attacker-controlled directory. When a privileged process archives an untrusted directory, the function follows symlinks without verifying that resolved targets remain within the source root, causing out-of-bounds files to be included in the archive as regular files and disclosed to the attacker.
- References