CVE-2021-38511

HIGH 7.5CVE-2021-38511 · Published 10/08/2021 · updated 17/06/2026

In short

CVE-2021-38511 is a HIGH (CVSS 7.5) vulnerability affecting tar (tar project).
Chance of exploitation in the next 30 days (EPSS): 1.4%, higher than 72.4% of all vulnerabilities.
Fix: update to 0.4.36 or later.

Package	Affected versions	Patched versions
tar tar_project	`< 0.4.36`	`0.4.36`

Description

An issue was discovered in the tar crate before 0.4.36 for Rust. When symlinks are present in a TAR archive, extraction can create arbitrary directories via .. traversal.

References

raw.githubusercontent.com/rustsec/advisory-db/main/crates/tar/RUSTSEC-2021-0080.md · Exploit
rustsec.org/advisories/RUSTSEC-2021-0080.html · Exploit

More vulnerabilities in tar

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free