RUSTSEC-2026-0425: `nix-nar`: `Decoder::unpack` writes archive entries outside the destination directory (path traversal)

`Decoder::unpack` does not safely contain the paths it extracts, so a malicious NAR archive can create files **outside** the destination directory — a path traversal (CWE-22). In `src/dec.rs` (`Decoder::unpack`): - A symlink entry's target is written without checking where it points (`src/dec.rs:153`), so the archive can create a symlink that escapes the destination directory. - The out-of-destination containment check compares path **strings** only and does not account for symlinks created earlier in the same unpack (`src/dec.rs:176-181`), before reaching the write sinks (`std::fs::create_dir` at `src/dec.rs:201` and `OpenOptions::open` at `src/dec.rs:218`). - The parser also accepts entry names containing `/` (`src/parser.rs:138-147`). Combined, a malicious archive can include a symlink `a` pointing at an external directory and then an entry named `a/b`, causing `b` to be written to `<external>/b`, outside the destination. This can create new files anywhere the process can write (it cannot overwrite existing files), which is escalatable to code execution by planting files in attacker-chosen locations.

• Kimlik doğrulamasız
• Yol geçişi

Yayın

30 Eki 2026

Güncelleme

30 Eki 2026

EPSS

—

CWE

—