{"id":"CVE-2018-20990","aliases":["GHSA-2367-c296-3mp2","RUSTSEC-2018-0002"],"url":"https://o3.security/vulnerability/CVE-2018-20990","summary":"Arbitrary file overwrite in tar-rs","details":"An issue was discovered in the tar crate before 0.4.16 for Rust. Arbitrary file overwrite can occur via a symlink or hardlink in a TAR archive.","published":"2019-08-26T13:15:11.070Z","modified":"2026-08-07T11:31:23.977896008Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"tar","fixedVersion":"0.4.16"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2018-0002.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-07T11:31:23.977896008Z"}}