CVE-2026-70622

A flaw was found in tar-rs. This vulnerability, a symlink escape, allows a local attacker to read sensitive files outside of the intended directory. By planting specially crafted symbolic links in an untrusted directory, an attacker can trick a privileged process, when archiving that directory, into including arbitrary files from the system. This leads to the disclosure of potentially confidential information to the attacker.

This flaw has a Moderate impact. tar-rs (the Rust tar crate) from 0.4.11 through 0.4.46 follows symlinks in Builder::append_dir_all() when creating an archive, so a privileged process that archives an attacker-controlled directory can be tricked into including files from outside the source root, disclosing them to the attacker. Exploitation requires a privileged process to invoke the archive-creation (write) path - append_dir_all/append_dir/append_path with symlink-following enabled - over an untrusted, attacker-writable directory; the extraction/read path, archivers that operate only on trusted or process-generated content, and callers that set follow_symlinks(false) are not affected. Across Red Hat's offerings only OpenShift Update Service (Cincinnati) exercises this pattern - it archives directories extracted from externally-sourced graph-data tarballs and pulled image layers - and is marked affected. All other Red Hat products that bundle the Rust tar crate were reviewed via deep-check and found not affected: they use the crate only at build time, only on the extraction/read path, only over trusted/process-generated content, or with symlink following disabled.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.