RUSTSEC-2026-0328: `decompress`: tar-family extractors write archive entries without a path-traversal check (tar-slip)

What to do

1. Find who pulls it in: cargo tree -i decompress.
2. Avoid the affected API (decompress::decompress), or replace the crate.

Details from the advisory

The tar-family extractors in decompress (.tar, .tar.gz, .tar.xz, .tar.bz2, .tar.zst) build each output path from the **raw archive entry path** and write to it with no traversal check, so a malicious archive can write files **outside** the destination directory, a "tar-slip" / zip-slip path traversal (CWE-22 / CWE-23).

In src/decompressors/tar_common.rs (tar_extract):

let filepath = entry.path()?;                                    // raw entry path
let filepath = filepath.components().skip(opts.strip).collect::<PathBuf>();
                                     // strips leading components only ,  keeps `..`
let outpath = to.join(filepath);
// ...
let mut outfile = fs::File::create(&outpath)?;                   // writes anywhere

.components().skip(opts.strip) removes a fixed number of *leading* path components but leaves interior .. components intact so an entry named e.g. ../../../../home/<user>/.bashrc, or an absolute path, resolves **outside** to. This affects all platforms.

References

• Package: crates.io/crates/decompress
• Advisory: rustsec.org/advisories/RUSTSEC-2026-0328.html
• Report: github.com/rusty-ferris-club/decompress/issues/21

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.