{"id":"RUSTSEC-2026-0425","revision":"434f0240efb6418dbb892f9d08eb5d13","records":[{"revision":"434f0240efb6418dbb892f9d08eb5d13","observedAt":"2026-10-30T10:49:03.467+00:00","statement":{"source":"osv","id":"RUSTSEC-2026-0425","aliases":[],"title":"`nix-nar`: `Decoder::unpack` writes archive entries outside the destination directory (path traversal)","description":"`Decoder::unpack` does not safely contain the paths it extracts, so a malicious NAR\narchive can create files **outside** the destination directory — a path traversal\n(CWE-22).\n\nIn `src/dec.rs` (`Decoder::unpack`):\n\n- A symlink entry's target is written without checking where it points\n  (`src/dec.rs:153`), so the archive can create a symlink that escapes the\n  destination directory.\n- The out-of-destination containment check compares path **strings** only and does\n  not account for symlinks created earlier in the same unpack\n  (`src/dec.rs:176-181`), before reaching the write sinks\n  (`std::fs::create_dir` at `src/dec.rs:201` and `OpenOptions::open` at\n  `src/dec.rs:218`).\n- The parser also accepts entry names containing `/` (`src/parser.rs:138-147`).\n\nCombined, a malicious archive can include a symlink `a` pointing at an external\ndirectory and then an entry named `a/b`, causing `b` to be written to\n`<external>/b`, outside the destination. This can create new files anywhere the\nprocess can write (it cannot overwrite existing files), which is escalatable to code\nexecution by planting files in attacker-chosen locations.","state":0,"publishedAt":"2026-10-30T12:00:00+00:00","modifiedAt":"2026-10-30T10:45:03.9690866+00:00","affected":[{"ecosystem":"crates.io","name":"nix-nar","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.0-0"},{"kind":"fixed","version":"0.6.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","score":null,"severity":null}],"references":["https://crates.io/crates/nix-nar","https://rustsec.org/advisories/RUSTSEC-2026-0425.html","https://codeberg.org/scvalex/nix-nar-rs/issues/3"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0425","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2026-0425","identifiers":["RUSTSEC-2026-0425"]},"retained":false,"historicalAffected":[]}],"coverage":[]}