decompress

Version	Released
`0.6.0` unknown 1 CVE	Feb 27, 2023
`0.5.0` unknown 1 CVE	Feb 27, 2023
`0.4.0` unknown 1 CVE	Feb 27, 2023
`0.3.0` unknown 1 CVE	Jan 21, 2023
`0.2.0` unknown 1 CVE	Dec 22, 2022
`0.1.0` unknown 1 CVE	Nov 28, 2022

0.6.0 unknown

1 CVE

RUSTSEC-2026-0328 Sep 19, 2026

`decompress`: tar-family extractors write archive entries without a path-traversal check (tar-slip)

7.1 / 10

High

Local Low None Required Unchanged None High High

The tar-family extractors in decompress (.tar, .tar.gz, .tar.xz, .tar.bz2, .tar.zst) build each output path from the raw archive entry path and write to it with no traversal check, so a malicious archive can write files outside the destination directory, a "tar-slip" / zip-slip path traversal (CWE-22 / CWE-23).

In src/decompressors/tar_common.rs (tar_extract):

let filepath = entry.path()?;                                    // raw entry path
let filepath = filepath.components().skip(opts.strip).collect::<PathBuf>();
                                     // strips leading components only — keeps `..`
let outpath = to.join(filepath);
// ...
let mut outfile = fs::File::create(&outpath)?;                   // writes anywhere

.components().skip(opts.strip) removes a fixed number of leading path components but leaves interior .. components intact so an entry named e.g. ../../../../home/<user>/.bashrc, or an absolute path, resolves outside to. This affects all platforms.

References

Updated Oct 03, 2026 · Source: OSV.dev

Feb 27, 2023

0.5.0 unknown

1 CVE

RUSTSEC-2026-0328 Sep 19, 2026

`decompress`: tar-family extractors write archive entries without a path-traversal check (tar-slip)

7.1 / 10

High

Local Low None Required Unchanged None High High

The tar-family extractors in decompress (.tar, .tar.gz, .tar.xz, .tar.bz2, .tar.zst) build each output path from the raw archive entry path and write to it with no traversal check, so a malicious archive can write files outside the destination directory, a "tar-slip" / zip-slip path traversal (CWE-22 / CWE-23).

In src/decompressors/tar_common.rs (tar_extract):

let filepath = entry.path()?;                                    // raw entry path
let filepath = filepath.components().skip(opts.strip).collect::<PathBuf>();
                                     // strips leading components only — keeps `..`
let outpath = to.join(filepath);
// ...
let mut outfile = fs::File::create(&outpath)?;                   // writes anywhere

.components().skip(opts.strip) removes a fixed number of leading path components but leaves interior .. components intact so an entry named e.g. ../../../../home/<user>/.bashrc, or an absolute path, resolves outside to. This affects all platforms.

References

Updated Oct 03, 2026 · Source: OSV.dev

Feb 27, 2023

0.4.0 unknown

1 CVE

RUSTSEC-2026-0328 Sep 19, 2026

`decompress`: tar-family extractors write archive entries without a path-traversal check (tar-slip)

7.1 / 10

High

Local Low None Required Unchanged None High High

The tar-family extractors in decompress (.tar, .tar.gz, .tar.xz, .tar.bz2, .tar.zst) build each output path from the raw archive entry path and write to it with no traversal check, so a malicious archive can write files outside the destination directory, a "tar-slip" / zip-slip path traversal (CWE-22 / CWE-23).

In src/decompressors/tar_common.rs (tar_extract):

let filepath = entry.path()?;                                    // raw entry path
let filepath = filepath.components().skip(opts.strip).collect::<PathBuf>();
                                     // strips leading components only — keeps `..`
let outpath = to.join(filepath);
// ...
let mut outfile = fs::File::create(&outpath)?;                   // writes anywhere

.components().skip(opts.strip) removes a fixed number of leading path components but leaves interior .. components intact so an entry named e.g. ../../../../home/<user>/.bashrc, or an absolute path, resolves outside to. This affects all platforms.

References

Updated Oct 03, 2026 · Source: OSV.dev

Feb 27, 2023

0.3.0 unknown

1 CVE

RUSTSEC-2026-0328 Sep 19, 2026

`decompress`: tar-family extractors write archive entries without a path-traversal check (tar-slip)

7.1 / 10

High

Local Low None Required Unchanged None High High

The tar-family extractors in decompress (.tar, .tar.gz, .tar.xz, .tar.bz2, .tar.zst) build each output path from the raw archive entry path and write to it with no traversal check, so a malicious archive can write files outside the destination directory, a "tar-slip" / zip-slip path traversal (CWE-22 / CWE-23).

In src/decompressors/tar_common.rs (tar_extract):

let filepath = entry.path()?;                                    // raw entry path
let filepath = filepath.components().skip(opts.strip).collect::<PathBuf>();
                                     // strips leading components only — keeps `..`
let outpath = to.join(filepath);
// ...
let mut outfile = fs::File::create(&outpath)?;                   // writes anywhere

.components().skip(opts.strip) removes a fixed number of leading path components but leaves interior .. components intact so an entry named e.g. ../../../../home/<user>/.bashrc, or an absolute path, resolves outside to. This affects all platforms.

References

Updated Oct 03, 2026 · Source: OSV.dev

Jan 21, 2023

0.2.0 unknown

1 CVE

RUSTSEC-2026-0328 Sep 19, 2026

`decompress`: tar-family extractors write archive entries without a path-traversal check (tar-slip)

7.1 / 10

High

Local Low None Required Unchanged None High High

The tar-family extractors in decompress (.tar, .tar.gz, .tar.xz, .tar.bz2, .tar.zst) build each output path from the raw archive entry path and write to it with no traversal check, so a malicious archive can write files outside the destination directory, a "tar-slip" / zip-slip path traversal (CWE-22 / CWE-23).

In src/decompressors/tar_common.rs (tar_extract):

let filepath = entry.path()?;                                    // raw entry path
let filepath = filepath.components().skip(opts.strip).collect::<PathBuf>();
                                     // strips leading components only — keeps `..`
let outpath = to.join(filepath);
// ...
let mut outfile = fs::File::create(&outpath)?;                   // writes anywhere

.components().skip(opts.strip) removes a fixed number of leading path components but leaves interior .. components intact so an entry named e.g. ../../../../home/<user>/.bashrc, or an absolute path, resolves outside to. This affects all platforms.

References

Updated Oct 03, 2026 · Source: OSV.dev

Dec 22, 2022

0.1.0 unknown

1 CVE

RUSTSEC-2026-0328 Sep 19, 2026

`decompress`: tar-family extractors write archive entries without a path-traversal check (tar-slip)

7.1 / 10

High

Local Low None Required Unchanged None High High

The tar-family extractors in decompress (.tar, .tar.gz, .tar.xz, .tar.bz2, .tar.zst) build each output path from the raw archive entry path and write to it with no traversal check, so a malicious archive can write files outside the destination directory, a "tar-slip" / zip-slip path traversal (CWE-22 / CWE-23).

In src/decompressors/tar_common.rs (tar_extract):

let filepath = entry.path()?;                                    // raw entry path
let filepath = filepath.components().skip(opts.strip).collect::<PathBuf>();
                                     // strips leading components only — keeps `..`
let outpath = to.join(filepath);
// ...
let mut outfile = fs::File::create(&outpath)?;                   // writes anywhere

.components().skip(opts.strip) removes a fixed number of leading path components but leaves interior .. components intact so an entry named e.g. ../../../../home/<user>/.bashrc, or an absolute path, resolves outside to. This affects all platforms.

References

Updated Oct 03, 2026 · Source: OSV.dev

Nov 28, 2022

Activity

Details