The vulnerability in tar-rs (CVE-2026-70622) involves improper link resolution before file access in the Builder::append_dir_all() function. Specifically, when archiving directories, the function follows symbolic links without ensuring that the resolved paths stay within the source root directory. This symlink escape vulnerability allows attackers who can control directory contents to cause files outside the intended directory to be included in the archive as regular files, leading to unauthorized file disclosure. The affected versions are from 0.4.11 through 0.4.46 inclusive. The CVSS 4.0 score is 7.1 (high severity), indicating network attack vector, low attack complexity, no privileges required beyond low, no user interaction, and high confidentiality impact. No vendor advisory or patch information is currently available.

An attacker able to control directory contents that are archived by a privileged process can cause files outside the intended source directory to be included in the archive. This results in unauthorized disclosure of files outside the source root, potentially exposing sensitive information. The vulnerability does not require user interaction and can be exploited remotely over the network with low complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid archiving untrusted directories with privileged processes using affected versions of tar-rs. Monitor vendor communications for updates on patches or official mitigations.