PT-2026-26573 · Tar-Rs+2 · Tar-Rs+2

Xokdvium · Published 2026-03-19 · Updated 2026-04-14 · CVE-2026-33056

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions tar-rs versions 0.4.44 and below

Description The tar-rs crate’s unpack dir function uses fs::metadata() to verify if a path already exists as a directory during tar archive unpacking. Because fs::metadata() follows symbolic links, a specially crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to incorrectly treat the symlink target as a valid existing directory. This leads to the application of chmod to the target, allowing an attacker to modify permissions of arbitrary directories outside the extraction root. The fs::metadata() function follows symbolic links, which is the root cause of the issue. The fix involves using fs::symlink metadata() in unpack dir to detect and reject symlinks instead of following them.

Recommendations Versions 0.4.44 and below should be updated to version 0.4.45 or later.

Exploit

Fix

Weakness Enumeration

CWE-61

Related Identifiers

BDU:2026-05929

CVE-2026-33056

GHSA-J4XF-2G29-59PH

RUSTSEC-2026-0067

USN-8138-1

USN-8138-2

USN-8139-1

USN-8168-1

USN-8168-2

Affected Products

Linuxmint

Ubuntu

Tar-Rs

References · 35

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33056.json · Exploit
• 🔥 https://github.com/alexcrichton/tar-rs/security/advisories/GHSA-j4xf-2g29-59ph · Exploit
• https://github.com/alexcrichton/tar-rs/commit/17b1fd84e632071cb8eef9d3709bf347bd266446 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-33056 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33056 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-33056 · Security Note
• https://osv.dev/vulnerability/USN-8168-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8168-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2026-33056 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33056 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-33056 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8139-1 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-33056 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8168-2 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8138-2 · Vendor Advisory