CVE-2021-38511: Tar Project Tar

High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days.

An issue was discovered in the tar crate before 0.4.36 for Rust. When symlinks are present in a TAR archive, extraction can create arbitrary directories via .. traversal.

Affected products

• Tar Project Tar: before 0.4.36 (fixed in 0.4.36)

Published 2021-08-10. Last modified 2026-06-17.