astral-sh tokio-tar up to 0.5.3 Entry::unpack_in_raw path traversal

Summaryinfo

A vulnerability marked as critical has been reported in astral-sh tokio-tar up to 0.5.3. The impacted element is the function Entry::unpack_in_raw. This manipulation causes path traversal. This vulnerability is handled as CVE-2025-59825. It is possible to launch the attack on the local host. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability has been found in astral-sh tokio-tar up to 0.5.3 and classified as critical. Affected by this vulnerability is the function Entry::unpack_in_raw. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.3 and earlier of astral-tokio-tar, tar archives may extract outside of their intended destination directory when using the Entry::unpack_in_raw API. Additionally, the Entry::allow_external_symlinks control (which defaults to true) could be bypassed via a pair of symlinks that individually point within the destination but combine to point outside of it. These behaviors could be used individually or combined to bypass the intended security control of limiting extraction to the given directory. This in turn would allow an attacker with a malicious tar archive to perform an arbitrary file write and potentially pivot into code execution. This issue has been patched in version 0.5.4. There is no workaround other than upgrading.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2025-59825 since 09/22/2025. The exploitation appears to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1006 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 266051 (Linux Distros Unpatched Vulnerability : CVE-2025-59825), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 0.5.4 eliminates this vulnerability. Applying the patch 036fdecc85c52458ace92dc9e02e9cef90684e75 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (266051) and EUVD (EUVD-2025-30897). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• astral-sh

Name

• tokio-tar

Version

• 0.5.0
• 0.5.1
• 0.5.2
• 0.5.3

License

• open-source

Website

• Product: https://github.com/astral-sh/tokio-tar/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion