dotnet · Microsoft.NETCore.App.Runtime.linux-x64Heads-up
Microsoft.NETCore.App.Runtime.linux-x64 Symlink Traversal in TarFile.ExtractToDirectory
A tampering vulnerability in System.
What changed
A tampering vulnerability in System.Formats.Tar's TarFile.ExtractToDirectory method allows symlink path traversal for arbitrary file writes outside the intended extraction directory.
Who it affects
Any Microsoft .NET project using affected package versions: Microsoft.NETCore.App.Runtime >=10.0.0 <=10.0.8, >=9.0.0 <=9.0.16, >=8.0.0 <=8.0.27.
What to do today
Update to patched versions: 10.0.9, 9.0.17, or 8.0.28. Restart apps. Recompile self-contained deployments.
The trail
Collected→
Audited→
Written→
Published