CVE-2025-59825

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-59825
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59825.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-59825
Aliases
Downstream
Published
2025-09-23T20:00:44.253Z
Modified
2026-04-02T12:57:01.388100Z
Severity
  • 6.1 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U CVSS Calculator
Summary
astral-tokio-tar has a path traversal in tar extraction
Details

astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.3 and earlier of astral-tokio-tar, tar archives may extract outside of their intended destination directory when using the Entry::unpackinraw API. Additionally, the Entry::allowexternalsymlinks control (which defaults to true) could be bypassed via a pair of symlinks that individually point within the destination but combine to point outside of it. These behaviors could be used individually or combined to bypass the intended security control of limiting extraction to the given directory. This in turn would allow an attacker with a malicious tar archive to perform an arbitrary file write and potentially pivot into code execution. This issue has been patched in version 0.5.4. There is no workaround other than upgrading.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59825.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22",
        "CWE-61"
    ]
}
References

Affected packages

Git / github.com/astral-sh/tokio-tar

Affected ranges

Type
GIT
Repo
https://github.com/astral-sh/tokio-tar
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8e0c27d4e657499bf1717b6661b2b63b86191774

Affected versions

Other
9b5e692
b1e6022
ba2b140
c06006a
efeaea9
v0.*
v0.5.0
v0.5.1
v0.5.2
v0.5.3
v5.*
v5.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59825.json"