PT-2025-39215 · Unknown+1 · Astral-Tokio-Tar+1

Published 2025-09-23 · Updated 2025-11-26 · CVE-2025-59825

Positive Technologies (AI Summary)

CVSS v4.0

6.1

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions astral-tokio-tar versions 0.5.3 and earlier

Description astral-tokio-tar is a tar archive reading/writing library for async Rust. Tar archives may extract files outside of their intended destination directory when using the Entry::unpack in raw API. The Entry::allow external symlinks control could be bypassed using symlinks that, when combined, point outside the destination directory. These behaviors could allow an attacker with a malicious tar archive to perform arbitrary file writes and potentially achieve code execution.

Recommendations Upgrade to version 0.5.4 or later.

Exploit

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

CWE-61

Related Identifiers

CVE-2025-59825

GHSA-3WGQ-WRWC-VQMV

Affected Products

Debian

Astral-Tokio-Tar

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59825.json · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-59825 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-59825 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3wgq-wrwc-vqmv · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-59825 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-59825 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-59825 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59825 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59825 · Security Note
• https://github.com/astral-sh/uv/issues/12163 · Note
• https://github.com/google/security-research/security/advisories/GHSA-9p78-p5g6-gcj8 · Note
• https://github.com/astral-sh/tokio-tar · Note
• https://github.com/astral-sh/tokio-tar/commit/036fdecc85c52458ace92dc9e02e9cef90684e75 · Note
• https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-3wgq-wrwc-vqmv · Note
• https://twitter.com/CVEnew/status/1970621784442757594 · Twitter Post