CVE-2026-45491: 
C# vulnerability analysis and mitigation

CVE-2026-45491 is a tampering vulnerability in Microsoft .NET's System.Formats.Tar library, specifically in the TarFile.ExtractToDirectory method, where improper symbolic link resolution enables symlink path traversal and arbitrary file writes outside the intended extraction directory. It was published on June 9, 2026, as part of Microsoft's June 2026 Patch Tuesday, and the GitHub Advisory was reviewed on June 16, 2026. Affected versions include .NET 8.0.0–8.0.27, .NET 9.0.0–9.0.16, and .NET 10.0.0–10.0.8, across all platforms and architectures. The CVSS v3.1 base score is 5.5 (Medium) per NVD, though the GitHub Advisory Database rates it 6.8 (Moderate) (GitHub Advisory, MSRC).

The root cause is CWE-59 (Improper Link Resolution Before File Access / 'Link Following'): the TarFile.ExtractToDirectory method in System.Formats.Tar does not adequately validate or resolve symbolic links within a TAR archive before writing files to disk. An attacker can craft a malicious TAR archive containing a symlink that points to an arbitrary path outside the intended extraction directory; when the archive is extracted, subsequent file entries are written to the symlink's target, enabling arbitrary file writes. Exploitation requires local access and low privileges (or no privileges, per the GitHub Advisory's CVSS), and no user interaction is needed. No public proof-of-concept code has been identified at this time (GitHub Advisory, MSRC).

Successful exploitation allows a local attacker to write arbitrary files to locations outside the intended extraction directory, resulting in high integrity impact with no confidentiality or availability impact (per NVD CVSS). In practice, this could enable an attacker to overwrite sensitive system files, configuration files, or executables, potentially leading to privilege escalation or persistent access if critical files are replaced. Self-contained .NET applications targeting affected versions are also vulnerable and must be recompiled and redeployed (GitHub Advisory).

1. Craft a malicious TAR archive: Create a TAR archive containing a symlink entry (e.g., link -> /etc/cron.d/ or another sensitive directory) pointing to a target path outside the intended extraction directory.
2. Add a payload file: Add a second entry in the TAR archive with a path relative to the symlink name (e.g., link/malicious_cron_job), so that when extracted, it is written to the symlink's target location.
3. Deliver the archive: Place the malicious TAR archive in a location accessible to a .NET application that calls TarFile.ExtractToDirectory() on untrusted input, or directly invoke extraction as a local user.
4. Trigger extraction: Cause the vulnerable .NET application to extract the archive using TarFile.ExtractToDirectory(). The method follows the symlink without proper validation, writing the payload file to the attacker-controlled target path.
5. Achieve objective: Depending on the target path and file written, the attacker may overwrite configuration files, inject scripts into privileged directories, or otherwise tamper with the system to escalate privileges or maintain persistence (GitHub Advisory).

• File System: Unexpected files appearing in directories outside the intended TAR extraction path; symbolic links created in temporary or application extraction directories pointing to sensitive system paths; newly created or modified files in privileged directories (e.g., /etc/, cron directories, startup folders) with timestamps matching extraction events.
• Logs: Application logs showing TarFile.ExtractToDirectory operations on externally supplied or untrusted TAR archives; file system audit logs recording writes to sensitive paths by .NET runtime processes (dotnet, application executables).
• Process: .NET runtime processes (dotnet.exe or self-contained app executables) performing unexpected file write operations to paths outside their working or output directories.

Microsoft has released patched versions addressing this vulnerability: .NET 8.0.28, .NET 9.0.17, and .NET 10.0.9. Users should update their .NET runtime or SDK to the appropriate patched version immediately; Visual Studio users will be prompted to update via Visual Studio. Self-contained applications targeting affected versions must be recompiled and redeployed against the patched runtime. As a workaround where immediate patching is not possible, avoid passing untrusted TAR archives to TarFile.ExtractToDirectory(), or implement pre-extraction validation to detect and reject symlink entries pointing outside the target directory (GitHub Advisory, MSRC).

The vulnerability was covered as part of broader June 2026 Patch Tuesday reporting by outlets including BleepingComputer, CyberSecurityNews, Rapid7, and Zero Day Initiative, which noted the overall release addressed approximately 200 vulnerabilities including multiple zero-days (BleepingComputer, Rapid7). The .NET-specific advisory was announced via the official dotnet/announcements GitHub repository. Red Hat, Ubuntu, AlmaLinux, Rocky Linux, and Oracle Linux all issued corresponding security advisories and errata for their .NET packages, reflecting broad cross-platform impact (GitHub Advisory).