`nix-nar`: `Decoder::unpack` writes archive entries outside the destination directory (path traversal)

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

`Decoder::unpack` does not safely contain the paths it extracts, so a malicious NAR archive can create files **outside** the destination directory — a path traversal (CWE-22). In `src/dec.rs` (`Decoder::unpack`): - A symlink entry's target is written without checking where it points (`src/dec.rs:153`), so the archive can create a symlink that escapes the destination directory. - The out-of-destination containment check compares path **strings** only and does not account for symlinks created earlier in the same unpack (`src/dec.rs:176-181`), before reaching the write sinks (`std::fs::create_dir` at `src/dec.rs:201` and `OpenOptions::open` at `src/dec.rs:218`). - The parser also accepts entry names containing `/` (`src/parser.rs:138-147`). Combined, a malicious archive can include a symlink `a` pointing at an external directory and then an entry named `a/b`, causing `b` to be written to `<external>/b`, outside the destination. This can create new files anywhere the process can write (it cannot overwrite existing files), which is escalatable to code execution by planting files in attacker-chosen locations.

Source published

30 Oct 2026 12:00:00 UTC

Source modified

30 Oct 2026 10:45:03 UTC

Observed here

30 Oct 2026 10:49:03 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N