CVE-2021-38511

7.5 HIGH

An issue was discovered in the tar crate before 0.4.36 for Rust

Published: 2021-08-10 · Last updated: 2026-06-17

Severity and scoring

CVSS: 7.5 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE: CWE-59

Affected products

Vendor	Product
tar_project	tar

Description

An issue was discovered in the tar crate before 0.4.36 for Rust. When symlinks are present in a TAR archive, extraction can create arbitrary directories via .. traversal.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2021-38511
[Exploit reference]https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/tar/RUSTSEC-2021-0080.md
[Exploit reference]https://rustsec.org/advisories/RUSTSEC-2021-0080.html
[Exploit reference]https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/tar/RUSTSEC-2021-0080.md
[Exploit reference]https://rustsec.org/advisories/RUSTSEC-2021-0080.html

Related CVEs

Same CWE

CVE-2026-50656 — Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as ... (7.8 HIGH)
CVE-2026-54230 — A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport (7.0 HIGH)
CVE-2026-54056 — Kitty is a cross-platform GPU based terminal (7.6 HIGH)
CVE-2026-54055 — Kitty is a cross-platform GPU based terminal (5.0 MEDIUM)
CVE-2025-46293 — This issue was addressed with improved handling of symlinks (5.5 MEDIUM)