MEDIUM 6.5 Microsoft

CVE-2026-70622

tar-rs 0.4.11 - 0.4.46 Symlink Escape via append_dir_all()

Microsoft Security Update 2026-Aug: tar-rs 0.4.11 - 0.4.46 Symlink Escape via append_dir_all()

Affected Products

azl3 kata-containers 3.32.0.kata0-2 on Azure Linux 3.0
azl3 trident 0.26.0-1 on Azure Linux 3.0
azl3 kata-containers 4.1.0.kata0-1 on Azure Linux 3.0
azl3 clamav 1.5.3-1 on Azure Linux 3.0
azl3 kata-containers-cc 3.15.0.aks0-16 on Azure Linux 3.0
azl3 rpm-ostree 2024.4-11 on Azure Linux 3.0
azl3 rust 1.75.0-30 on Azure Linux 3.0
azl3 rust 1.90.0-10 on Azure Linux 3.0

References

Published: 2026-08-11 · Source: Microsoft · Feed updated: 2026-09-24

This medium severity vulnerability with a CVSS score of 6.5 was published on 2026-08-11 via Microsoft. Affected: azl3 kata-containers 3.32.0.kata0-2 on Azure Linux 3.0, azl3 trident 0.26.0-1 on Azure Linux 3.0, azl3 kata-containers 4.1.0.kata0-1 on Azure Linux 3.0 and 5 more.

vulnfeed aggregates 11711 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.