`decompress`: tar-family extractors write archive entries without a path-traversal check (tar-slip)

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

The tar-family extractors in `decompress` (`.tar`, `.tar.gz`, `.tar.xz`, `.tar.bz2`, `.tar.zst`) build each output path from the **raw archive entry path** and write to it with no traversal check, so a malicious archive can write files **outside** the destination directory, a "tar-slip" / zip-slip path traversal (CWE-22 / CWE-23). In `src/decompressors/tar_common.rs` (`tar_extract`): ```rust let filepath = entry.path()?; // raw entry path let filepath = filepath.components().skip(opts.strip).collect::<PathBuf>(); // strips leading components only — keeps `..` let outpath = to.join(filepath); // ... let mut outfile = fs::File::create(&outpath)?; // writes anywhere ``` `.components().skip(opts.strip)` removes a fixed number of *leading* path components but leaves interior `..` components intact so an entry named e.g. `../../../../home/<user>/.bashrc`, or an absolute path, resolves **outside** `to`. This affects all platforms.

Source published

19 Sep 2026 12:00:00 UTC

Source modified

3 Oct 2026 07:30:03 UTC

Observed here

24 Oct 2026 13:19:54 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H