CVE-2026-33056

CVE-2026-33056 is a medium-severity vulnerability affecting the tar-rs Rust library (versions 0.4.44 and below), where its unpack_dir function mishandles symbolic links. A crafted tarball can exploit this to cause the library to apply chmod to arbitrary directories outside the extraction root, allowing an attacker to modify their permissions. Rated CVSS 6.5 (Medium), successful exploitation requires user interaction to unpack the malicious archive but has low attack complexity, leading to high integrity impact. There is no evidence of active exploitation or public exploit code, though the issue has been addressed in version 0.4.45 and has seen some community discussion.