{"id":"RUSTSEC-2026-0425","summary":"`nix-nar`: `Decoder::unpack` writes archive entries outside the destination directory (path traversal)","details":"`Decoder::unpack` does not safely contain the paths it extracts, so a malicious NAR\narchive can create files **outside** the destination directory — a path traversal\n(CWE-22).\n\nIn `src/dec.rs` (`Decoder::unpack`):\n\n- A symlink entry's target is written without checking where it points\n  (`src/dec.rs:153`), so the archive can create a symlink that escapes the\n  destination directory.\n- The out-of-destination containment check compares path **strings** only and does\n  not account for symlinks created earlier in the same unpack\n  (`src/dec.rs:176-181`), before reaching the write sinks\n  (`std::fs::create_dir` at `src/dec.rs:201` and `OpenOptions::open` at\n  `src/dec.rs:218`).\n- The parser also accepts entry names containing `/` (`src/parser.rs:138-147`).\n\nCombined, a malicious archive can include a symlink `a` pointing at an external\ndirectory and then an entry named `a/b`, causing `b` to be written to\n`\u003cexternal\u003e/b`, outside the destination. This can create new files anywhere the\nprocess can write (it cannot overwrite existing files), which is escalatable to code\nexecution by planting files in attacker-chosen locations.","modified":"2026-10-30T10:45:03.969086586Z","published":"2026-10-30T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/nix-nar"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0425.html"},{"type":"WEB","url":"https://codeberg.org/scvalex/nix-nar-rs/issues/3"}],"affected":[{"package":{"name":"nix-nar","ecosystem":"crates.io","purl":"pkg:cargo/nix-nar"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.6.0"}]}],"ecosystem_specific":{"affects":{"os":[],"functions":["nix_nar::Decoder::unpack"],"arch":[]},"affected_functions":null},"database_specific":{"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0425.json","categories":["code-execution"],"cvss":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}