IA Squad
SearchPT
dotnet · Microsoft.NETCore.App.Runtime.linux-x64Heads-up

Microsoft.NETCore.App.Runtime.linux-x64 Symlink Traversal in TarFile.ExtractToDirectory

A tampering vulnerability in System.

17 Jun 2026Read 1 minSeverity: schedule it

What changed

A tampering vulnerability in System.Formats.Tar's TarFile.ExtractToDirectory method allows symlink path traversal for arbitrary file writes outside the intended extraction directory.

Who it affects

Any Microsoft .NET project using affected package versions: Microsoft.NETCore.App.Runtime >=10.0.0 <=10.0.8, >=9.0.0 <=9.0.16, >=8.0.0 <=8.0.27.

What to do today

Update to patched versions: 10.0.9, 9.0.17, or 8.0.28. Restart apps. Recompile self-contained deployments.

The trail
Collected Audited Written Published