CVE-2026-45390 describes a directory traversal vulnerability (CWE-22) in OCaml-tar prior to version 3.4.0. The issue arises because ocaml-tar does not properly sanitize archive entry names containing '../' path segments, allowing files to be written outside the target extraction directory. This behavior differs from the standard tar(1) utility, which rejects such archives. The vulnerability has a CVSS v3.1 base score of 9.1, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impact. No official patch or remediation level is currently documented, and no known exploits in the wild have been reported.

An attacker able to provide a crafted tar archive to a decompression endpoint using vulnerable OCaml-tar versions can write arbitrary files outside the intended extraction directory. This can lead to unauthorized file modification or creation, potentially compromising system integrity and confidentiality. The vulnerability does not affect availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid decompressing untrusted tar archives with vulnerable OCaml-tar versions or implement additional validation to reject archives containing '../' path segments in entry names.