CVE-2026-70622: 
Clam AntiVirus vulnerability analysis and mitigation

CVE-2026-70622 is a symlink escape vulnerability in the Builder::append_dir_all() function of the tar-rs Rust library, affecting versions 0.4.11 through 0.4.46. The flaw allows an attacker who controls a directory being archived by a privileged process to plant symlinks that point outside the intended source root, causing out-of-bounds files to be included in the resulting archive as regular files and disclosed to the attacker. The vulnerability was published on August 10, 2026, and was assigned by VulnCheck. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory, VulnCheck Gist).

The root cause is classified as CWE-59 (Improper Link Resolution Before File Access / 'Link Following'). By default, tar::Builder::new() sets follow = true, meaning append_dir_all() dereferences symlinks when traversing the source directory using src.is_dir(), fs::read_dir(), fs::metadata(), and fs::File::open(). While archive entry names are correctly confined to src_path via path.join(src.strip_prefix(src_path).unwrap()), there is no corresponding check that the resolved symlink target remains within src_path before the file is read and embedded. This creates a mismatch: archive entry names are bounded by the source root, but filesystem reads are not. The vulnerability was introduced when Builder::append_dir_all() was added in commit a25da58 (merged before the 0.4.11 release in March 2017), and an opt-out (follow_symlinks(false)) was added later but the unsafe default was never changed (VulnCheck Gist).

Successful exploitation results in unauthorized disclosure of files outside the intended archive source directory, impacting confidentiality with no effect on integrity or availability. In the most dangerous scenario — a confused-deputy attack — a low-privileged attacker can cause a privileged process (e.g., a backup job, CI artifact packager, or workspace export service) to archive an attacker-controlled directory, embedding root-owned or otherwise inaccessible files as readable entries in the resulting archive. This can expose sensitive data such as private keys, configuration files, or secrets that the attacker could not read directly, and may facilitate further lateral movement if credentials or tokens are disclosed (VulnCheck Gist, GitHub Advisory).

A proof-of-concept (PoC) has been published as a GitHub Gist by the researcher thesmartshadow, demonstrating both a baseline symlink leak and a privileged export scenario using runnable Rust code and a shell script (VulnCheck Gist). CISA's SSVC assessment classifies exploitation as 'poc' with 'no' automatability and 'partial' technical impact. There is no evidence of active in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.34% (27th percentile), indicating a currently low probability of exploitation in the next 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Identify a target application: Find a service or privileged process (e.g., backup daemon, CI/CD pipeline, workspace export endpoint) that uses tar-rs Builder::append_dir_all() with default settings to archive a directory the attacker can write to.
2. Gain write access to the archived directory: Obtain low-privileged access to the system or service that allows placing files in the directory that will be archived (e.g., upload a file, write to a shared workspace).
3. Plant a symlink: Inside the attacker-controlled directory, create a symlink pointing to a target file or directory outside the source root that the privileged archiver can read but the attacker cannot directly access:

   ln -s /etc/shadow /attacker_dir/leak.txt
   # Or for a directory:
   ln -s /root/.ssh /attacker_dir/escape_dir

4. Trigger the archive operation: Cause the privileged process to invoke append_dir_all() on the attacker-controlled directory (e.g., trigger an export, backup, or packaging job).
5. Retrieve the archive: Download or access the resulting .tar file through the application's normal export/download mechanism.
6. Extract the out-of-bounds file: Read the sensitive file from the archive:

   tar -xOf /tmp/export.tar leak.txt
   tar -xOf /tmp/export.tar escape_dir/id_rsa

   The file contents are embedded as regular file entries, bypassing the original filesystem permissions (VulnCheck Gist).

• File System: Presence of unexpected symlinks in directories that are subject to archiving by privileged processes, particularly symlinks pointing to paths outside the directory tree (e.g., /etc/, /root/, /var/); generated .tar files containing entries whose resolved paths fall outside the original source root.
• Logs: Application or service logs showing archive creation jobs triggered by low-privileged users shortly before sensitive data exposure; audit logs (auditd) recording open() or read() syscalls by a privileged process on files outside the expected archive source directory.
• Process: Privileged archiver processes (e.g., backup daemons, export workers) opening files in sensitive system directories (/etc/, /root/, /home/) that are unrelated to the expected archive source path.

No patched release of tar-rs was available as of the disclosure date (August 10, 2026); the main branch of the repository was also reported as still affected. The primary workaround is to explicitly disable symlink following before calling append_dir_all() on any untrusted directory:

let mut b = tar::Builder::new(writer);
b.follow_symlinks(false);
b.append_dir_all("", untrusted_root)?;
b.finish()?;

With follow_symlinks(false), symlinks are stored as symlink entries in the archive rather than being dereferenced and embedded as regular files. Additionally, operators should restrict which users can write to directories that are archived by privileged processes, and implement access controls to prevent untrusted users from creating symlinks in those directories (VulnCheck Gist, GitHub Advisory).