ALPINE-CVE-2026-33056
- Source
- https://security.alpinelinux.org/vuln/CVE-2026-33056
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2026-33056.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/ALPINE-CVE-2026-33056
- Upstream
- Published
- 2026-03-20T08:16:11.603Z
- Modified
- 2026-03-25T08:30:50.093129Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVSS Calculator
- Summary
- [none]
- Details
-
tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45.
- References
Affected packages
Alpine:v3.20 / rust
Package
- Name
- rust
- Purl
- pkg:apk/alpine/rust?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed1.78.0-r1
Affected versions
1.*
1.10.0-r0
1.10.0-r1
1.16.0-r0
1.16.0-r1
1.16.0-r2
1.16.0-r3
1.16.0-r4
1.16.0-r5
1.17.0-r0
1.17.0-r1
1.17.0-r2
1.17.0-r3
1.18.0-r1
1.19.0-r0
1.20.0-r0
1.21.0-r0
1.21.0-r1
1.22.1-r0
1.23.0-r0
1.23.0-r1
1.24.0-r0
1.24.1-r0
1.25.0-r0
1.26.0-r0
1.26.0-r1
1.26.2-r0
1.27.0-r0
1.27.2-r0
1.28.0-r0
1.29.0-r0
1.30.0-r0
1.30.0-r1
1.31.1-r1
1.31.1-r2
1.32.0-r0
1.33.0-r0
1.34.2-r0
1.34.2-r1
1.35.0-r0
1.36.0-r0
1.37.0-r0
1.38.0-r0
1.38.0-r1
1.38.0-r2
1.39.0-r0
1.40.0-r0
1.40.0-r1
1.41.0-r0
1.41.0-r1
1.41.1-r0
1.42.0-r0
1.42.0-r1
1.42.0-r2
1.43.0-r0
1.43.1-r0
1.43.1-r1
1.44.0-r0
1.44.1-r0
1.45.1-r0
1.45.2-r0
1.46.0-r0
1.46.0-r1
1.46.0-r2
1.47.0-r0
1.47.0-r1
1.47.0-r2
1.48.0-r0
1.49.0-r0
1.50.0-r0
1.50.0-r1
1.51.0-r0
1.51.0-r1
1.51.0-r2
1.52.0-r0
1.52.1-r0
1.52.1-r1
1.53.0-r0
1.54.0-r0
1.55.0-r0
1.55.0-r1
1.55.0-r2
1.55.0-r3
1.56.1-r0
1.57.0-r0
1.58.0-r0
1.58.0-r1
1.58.1-r0
1.59.0-r0
1.59.0-r1
1.60.0-r0
1.60.0-r1
1.60.0-r2
1.60.0-r3
1.61.0-r0
1.62.0-r0
1.62.0-r1
1.62.1-r0
1.62.1-r1
1.62.1-r2
1.63.0-r0
1.64.0-r0
1.64.0-r1
1.64.0-r2
1.65.0-r0
1.65.0-r1
1.66.0-r0
1.66.1-r0
1.66.1-r1
1.66.1-r2
1.67.0-r0
1.67.0-r1
1.67.0-r2
1.67.1-r0
1.68.0-r0
1.68.0-r1
1.68.1-r0
1.68.2-r0
1.69.0-r0
1.69.0-r1
1.69.0-r2
1.69.0-r3
1.69.0-r4
1.69.0-r5
1.69.0-r6
1.69.0-r7
1.69.0-r8
1.69.0-r9
1.69.0-r10
1.70.0-r0
1.70.0-r1
1.70.0-r2
1.70.0-r3
1.70.0-r4
1.71.0-r0
1.71.0-r1
1.71.0-r2
1.71.1-r0
1.72.0-r0
1.72.1-r0
1.73.0-r0
1.74.1-r0
1.75.0-r0
1.76.0-r0
1.76.0-r1
1.77.0-r0
1.77.0-r1
1.78.0-r0
Alpine:v3.21 / rust
Package
- Name
- rust
- Purl
- pkg:apk/alpine/rust?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed1.83.0-r1
Affected versions
1.*
1.10.0-r0
1.10.0-r1
1.16.0-r0
1.16.0-r1
1.16.0-r2
1.16.0-r3
1.16.0-r4
1.16.0-r5
1.17.0-r0
1.17.0-r1
1.17.0-r2
1.17.0-r3
1.18.0-r1
1.19.0-r0
1.20.0-r0
1.21.0-r0
1.21.0-r1
1.22.1-r0
1.23.0-r0
1.23.0-r1
1.24.0-r0
1.24.1-r0
1.25.0-r0
1.26.0-r0
1.26.0-r1
1.26.2-r0
1.27.0-r0
1.27.2-r0
1.28.0-r0
1.29.0-r0
1.30.0-r0
1.30.0-r1
1.31.1-r1
1.31.1-r2
1.32.0-r0
1.33.0-r0
1.34.2-r0
1.34.2-r1
1.35.0-r0
1.36.0-r0
1.37.0-r0
1.38.0-r0
1.38.0-r1
1.38.0-r2
1.39.0-r0
1.40.0-r0
1.40.0-r1
1.41.0-r0
1.41.0-r1
1.41.1-r0
1.42.0-r0
1.42.0-r1
1.42.0-r2
1.43.0-r0
1.43.1-r0
1.43.1-r1
1.44.0-r0
1.44.1-r0
1.45.1-r0
1.45.2-r0
1.46.0-r0
1.46.0-r1
1.46.0-r2
1.47.0-r0
1.47.0-r1
1.47.0-r2
1.48.0-r0
1.49.0-r0
1.50.0-r0
1.50.0-r1
1.51.0-r0
1.51.0-r1
1.51.0-r2
1.52.0-r0
1.52.1-r0
1.52.1-r1
1.53.0-r0
1.54.0-r0
1.55.0-r0
1.55.0-r1
1.55.0-r2
1.55.0-r3
1.56.1-r0
1.57.0-r0
1.58.0-r0
1.58.0-r1
1.58.1-r0
1.59.0-r0
1.59.0-r1
1.60.0-r0
1.60.0-r1
1.60.0-r2
1.60.0-r3
1.61.0-r0
1.62.0-r0
1.62.0-r1
1.62.1-r0
1.62.1-r1
1.62.1-r2
1.63.0-r0
1.64.0-r0
1.64.0-r1
1.64.0-r2
1.65.0-r0
1.65.0-r1
1.66.0-r0
1.66.1-r0
1.66.1-r1
1.66.1-r2
1.67.0-r0
1.67.0-r1
1.67.0-r2
1.67.1-r0
1.68.0-r0
1.68.0-r1
1.68.1-r0
1.68.2-r0
1.69.0-r0
1.69.0-r1
1.69.0-r2
1.69.0-r3
1.69.0-r4
1.69.0-r5
1.69.0-r6
1.69.0-r7
1.69.0-r8
1.69.0-r9
1.69.0-r10
1.70.0-r0
1.70.0-r1
1.70.0-r2
1.70.0-r3
1.70.0-r4
1.71.0-r0
1.71.0-r1
1.71.0-r2
1.71.1-r0
1.72.0-r0
1.72.1-r0
1.73.0-r0
1.73.0-r1
1.74.1-r0
1.75.0-r0
1.76.0-r0
1.76.0-r1
1.77.0-r0
1.77.0-r1
1.78.0-r0
1.79.0-r0
1.79.0-r1
1.80.0-r0
1.80.1-r0
1.81.0-r0
1.82.0-r0
1.82.0-r1
1.82.0-r2
1.83.0-r0
Alpine:v3.22 / rust
Package
- Name
- rust
- Purl
- pkg:apk/alpine/rust?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed1.87.0-r1
Affected versions
1.*
1.10.0-r0
1.10.0-r1
1.16.0-r0
1.16.0-r1
1.16.0-r2
1.16.0-r3
1.16.0-r4
1.16.0-r5
1.17.0-r0
1.17.0-r1
1.17.0-r2
1.17.0-r3
1.18.0-r1
1.19.0-r0
1.20.0-r0
1.21.0-r0
1.21.0-r1
1.22.1-r0
1.23.0-r0
1.23.0-r1
1.24.0-r0
1.24.1-r0
1.25.0-r0
1.26.0-r0
1.26.0-r1
1.26.2-r0
1.27.0-r0
1.27.2-r0
1.28.0-r0
1.29.0-r0
1.30.0-r0
1.30.0-r1
1.31.1-r1
1.31.1-r2
1.32.0-r0
1.33.0-r0
1.34.2-r0
1.34.2-r1
1.35.0-r0
1.36.0-r0
1.37.0-r0
1.38.0-r0
1.38.0-r1
1.38.0-r2
1.39.0-r0
1.40.0-r0
1.40.0-r1
1.41.0-r0
1.41.0-r1
1.41.1-r0
1.42.0-r0
1.42.0-r1
1.42.0-r2
1.43.0-r0
1.43.1-r0
1.43.1-r1
1.44.0-r0
1.44.1-r0
1.45.1-r0
1.45.2-r0
1.46.0-r0
1.46.0-r1
1.46.0-r2
1.47.0-r0
1.47.0-r1
1.47.0-r2
1.48.0-r0
1.49.0-r0
1.50.0-r0
1.50.0-r1
1.51.0-r0
1.51.0-r1
1.51.0-r2
1.52.0-r0
1.52.1-r0
1.52.1-r1
1.53.0-r0
1.54.0-r0
1.55.0-r0
1.55.0-r1
1.55.0-r2
1.55.0-r3
1.56.1-r0
1.57.0-r0
1.58.0-r0
1.58.0-r1
1.58.1-r0
1.59.0-r0
1.59.0-r1
1.60.0-r0
1.60.0-r1
1.60.0-r2
1.60.0-r3
1.61.0-r0
1.62.0-r0
1.62.0-r1
1.62.1-r0
1.62.1-r1
1.62.1-r2
1.63.0-r0
1.64.0-r0
1.64.0-r1
1.64.0-r2
1.65.0-r0
1.65.0-r1
1.66.0-r0
1.66.1-r0
1.66.1-r1
1.66.1-r2
1.67.0-r0
1.67.0-r1
1.67.0-r2
1.67.1-r0
1.68.0-r0
1.68.0-r1
1.68.1-r0
1.68.2-r0
1.69.0-r0
1.69.0-r1
1.69.0-r2
1.69.0-r3
1.69.0-r4
1.69.0-r5
1.69.0-r6
1.69.0-r7
1.69.0-r8
1.69.0-r9
1.69.0-r10
1.70.0-r0
1.70.0-r1
1.70.0-r2
1.70.0-r3
1.70.0-r4
1.71.0-r0
1.71.0-r1
1.71.0-r2
1.71.1-r0
1.72.0-r0
1.72.1-r0
1.73.0-r0
1.73.0-r1
1.74.1-r0
1.75.0-r0
1.76.0-r0
1.76.0-r1
1.77.0-r0
1.77.0-r1
1.78.0-r0
1.79.0-r0
1.79.0-r1
1.80.0-r0
1.80.1-r0
1.81.0-r0
1.82.0-r0
1.82.0-r1
1.82.0-r2
1.83.0-r0
1.84.0-r0
1.84.1-r0
1.85.0-r0
1.85.1-r0
1.86.0-r0
1.86.0-r1
1.86.0-r2
1.87.0-r0
Alpine:v3.23 / rust
Package
- Name
- rust
- Purl
- pkg:apk/alpine/rust?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed1.91.1-r1
Affected versions
1.*
1.10.0-r0
1.10.0-r1
1.16.0-r0
1.16.0-r1
1.16.0-r2
1.16.0-r3
1.16.0-r4
1.16.0-r5
1.17.0-r0
1.17.0-r1
1.17.0-r2
1.17.0-r3
1.18.0-r1
1.19.0-r0
1.20.0-r0
1.21.0-r0
1.21.0-r1
1.22.1-r0
1.23.0-r0
1.23.0-r1
1.24.0-r0
1.24.1-r0
1.25.0-r0
1.26.0-r0
1.26.0-r1
1.26.2-r0
1.27.0-r0
1.27.2-r0
1.28.0-r0
1.29.0-r0
1.30.0-r0
1.30.0-r1
1.31.1-r1
1.31.1-r2
1.32.0-r0
1.33.0-r0
1.34.2-r0
1.34.2-r1
1.35.0-r0
1.36.0-r0
1.37.0-r0
1.38.0-r0
1.38.0-r1
1.38.0-r2
1.39.0-r0
1.40.0-r0
1.40.0-r1
1.41.0-r0
1.41.0-r1
1.41.1-r0
1.42.0-r0
1.42.0-r1
1.42.0-r2
1.43.0-r0
1.43.1-r0
1.43.1-r1
1.44.0-r0
1.44.1-r0
1.45.1-r0
1.45.2-r0
1.46.0-r0
1.46.0-r1
1.46.0-r2
1.47.0-r0
1.47.0-r1
1.47.0-r2
1.48.0-r0
1.49.0-r0
1.50.0-r0
1.50.0-r1
1.51.0-r0
1.51.0-r1
1.51.0-r2
1.52.0-r0
1.52.1-r0
1.52.1-r1
1.53.0-r0
1.54.0-r0
1.55.0-r0
1.55.0-r1
1.55.0-r2
1.55.0-r3
1.56.1-r0
1.57.0-r0
1.58.0-r0
1.58.0-r1
1.58.1-r0
1.59.0-r0
1.59.0-r1
1.60.0-r0
1.60.0-r1
1.60.0-r2
1.60.0-r3
1.61.0-r0
1.62.0-r0
1.62.0-r1
1.62.1-r0
1.62.1-r1
1.62.1-r2
1.63.0-r0
1.64.0-r0
1.64.0-r1
1.64.0-r2
1.65.0-r0
1.65.0-r1
1.66.0-r0
1.66.1-r0
1.66.1-r1
1.66.1-r2
1.67.0-r0
1.67.0-r1
1.67.0-r2
1.67.1-r0
1.68.0-r0
1.68.0-r1
1.68.1-r0
1.68.2-r0
1.69.0-r0
1.69.0-r1
1.69.0-r2
1.69.0-r3
1.69.0-r4
1.69.0-r5
1.69.0-r6
1.69.0-r7
1.69.0-r8
1.69.0-r9
1.69.0-r10
1.70.0-r0
1.70.0-r1
1.70.0-r2
1.70.0-r3
1.70.0-r4
1.71.0-r0
1.71.0-r1
1.71.0-r2
1.71.1-r0
1.72.0-r0
1.72.1-r0
1.73.0-r0
1.73.0-r1
1.74.1-r0
1.75.0-r0
1.76.0-r0
1.76.0-r1
1.77.0-r0
1.77.0-r1
1.78.0-r0
1.79.0-r0
1.79.0-r1
1.80.0-r0
1.80.1-r0
1.81.0-r0
1.82.0-r0
1.82.0-r1
1.82.0-r2
1.83.0-r0
1.84.0-r0
1.84.1-r0
1.85.0-r0
1.85.1-r0
1.86.0-r0
1.86.0-r1
1.86.0-r2
1.87.0-r0
1.87.0-r1
1.88.0-r0
1.88.0-r1
1.89.0-r0
1.90.0-r0
1.90.0-r1
1.91.0-r0
1.91.1-r0