CVE-2026-45491: Directory Traversal via Improper Link Resolution in .NET System.Formats.Tar

Vulnerability ID: CVE-2026-45491
CVSS Score: 6.2
Published: 2026-06-16

A directory traversal vulnerability exists in the Microsoft .NET System.Formats.Tar library during archive extraction. When extracting a TAR archive using the TarFile.ExtractToDirectory API, the extraction engine improperly resolves symbolic links prior to file creation, allowing local unauthorized attackers to write or overwrite arbitrary files outside the target directory. This can lead to local tampering, privilege escalation, or arbitrary code execution.

TL;DR

System.Formats.Tar in .NET 8.0, 9.0, and 10.0 fails to validate symbolic link targets during extraction, enabling local directory traversal and arbitrary file writes (Tar Slip).

Technical Details

• CWE ID: CWE-59
• Attack Vector: Local
• CVSS Base Score: 6.2
• EPSS Score: 0.00301 (21.55 percentile)
• Impact: High Integrity Tampering / Privilege Escalation
• Exploit Status: No public weaponized exploit code available
• CISA KEV Status: Not Listed

Affected Systems

• .NET Core and .NET runtimes on Linux (Ubuntu, RHEL, Rocky, Alma, Amazon Linux, Alpine, Oracle Linux)
• .NET Core and .NET runtimes on Windows
• ASP.NET Core applications incorporating archive upload or processing components
• .NET 8.0: >= 8.0.0 to < 8.0.28 (Fixed in: 8.0.28)
• .NET 9.0: >= 9.0.0 to < 9.0.17 (Fixed in: 9.0.17)
• .NET 10.0: >= 10.0.0 to < 10.0.9 (Fixed in: 10.0.9)

Code Analysis

Commit: e0f8bcb

Optimizes Directory.GetFiles on Windows and resolves NTSTATUS validation flaws

Commit: fc46e69

Fixes a thread safety and memory leak scenario on Linux inside MruCrlCache

Commit: 413eaa6

Fixes OverflowException and potential heap overflow issues inside JIT/VM StubSigBuilder

Commit: 5713889

Mitigates GC heap corruption scenarios when DOTNET_GCLargePages is enabled on Linux

Mitigation Strategies

• Upgrade .NET Core and .NET Runtimes to patched versions (8.0.28, 9.0.17, 10.0.9).
• Sanitize and resolve archive path boundaries manually before calling extraction APIs if upgrading is not immediately possible.
• Implement strict system privilege boundaries so .NET processes run with the least necessary privileges.

Remediation Steps:

1. Locate all installations of the .NET SDK and Runtime across development environments and production servers.
2. Apply June 2026 security updates using system package managers or by rebuilding container images with official updated base images.
3. Scan existing codebases for calls to System.Formats.Tar.TarFile.ExtractToDirectory and ensure they only ingest trusted archives.
4. Configure File Integrity Monitoring (FIM) to monitor sensitive directories for unexpected write activity.

References

• Microsoft Security Advisory
• CVE Authority Record
• Wiz Security Vulnerability DB Record
• Official .NET Runtime Repository

Read the full report for CVE-2026-45491 on our website for more details including interactive diagrams and full exploit analysis.