CVE-2026-70622: Composefs Tar-RS

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder::append_dir_all() function that allows attackers to read files outside the intended source root directory by planting symlinks in an attacker-controlled directory. When a privileged process archives an untrusted directory, the function follows symlinks without verifying that resolved targets remain within the source root, causing out-of-bounds files to be included in the archive as regular files and disclosed to the attacker.

Affected products

• Composefs Tar-RS: from 0.4.11, up to and including 0.4.46

Published 2026-08-10. Last modified 2026-09-24.