Links in archive can create arbitrary directories

published 2021-07-19 5 y ago modified 2026-07-17 3 mo ago also GHSA-62jx-8vmh-4mcw , RUSTSEC-2021-0080 , EUVD-2021-1587

cvss: 7.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.4%; EPSS 1.4% chance of exploitation in 30 days, percentile 72%
public exploits: 0; none known

An issue was discovered in the tar crate before 0.4.36 for Rust. When symlinks are present in a TAR archive, extraction can create arbitrary directories via .. traversal.

Patch / fix

fixed in 2 distros 1 links 1

crates.io tar 0.4.36
tar_project tar 0.4.36

rust-tar Debian 14, Debian 13, Debian 12 0.4.37-1

debian advisories DEBIAN-CVE-2021-38511

github.com/alexcrichton/tar-rs#259 pull request

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-38511 updated 2026-06-26 cvss 7.5

tar-crate: links in archive can create arbitrary directories

Red Hat Advanced Cluster Management for Kubernetes 2 cincinnati-container
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.39% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

rustsec.org https://rustsec.org/advisories/RUSTSEC-2021-0080.html referenced PoC, tagged "exploit" by a source, unverified
raw.githubusercontent.com https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/tar/RUSTSEC-2021-0080.md referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:N/I:P/A:N
GitHub	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
OSV	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem	package	affected	fixed in
crates.io	tar	<0.4.36 >=0.0.0-0, <0.4.36	0.4.36

Classification

Weakness

CWE-59 Improper Link Resolution Before File Access
CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

github.com /alexcrichton/tar-rs/pull/259
web
rustsec.org /advisories/RUSTSEC-2021-0080.html
web, exploit, third-party-advisory, advisory
raw.githubusercontent.com /rustsec/advisory-db/main/crates/tar/RUSTSEC-2021-0080.md
web, exploit, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2021-38511
advisory
github.com /alexcrichton/tar-rs/issues/238
web, report
github.com /alexcrichton/tar-rs
package
crates.io /crates/tar
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary