CVE-2026-45390: In OCaml-tar before 3

Synopsis

A path-traversal vulnerability in the OCaml-tar library (versions before 3.4.0) allows a crafted tar archive containing '../' path segments to write files outside the intended extraction directory. The vulnerability is reachable over the network with no authentication required and no victim interaction needed, making any service that accepts and decompresses tar archives a direct target. Successful exploitation gives an attacker arbitrary file write access on the host filesystem, which can lead to code execution or data tampering. No fix version has been published yet; HarborGuard tracks the advisory and will surface a patched-image rebuild as soon as upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the vulnerable tar-decompression endpoint over the network; any internet- or intranet-exposed service accepting tar archive uploads is in scope.

• AuthenticationNot required

  No credentials or session token are needed; the CVSS vector specifies PR:N, meaning an unauthenticated attacker can submit a malicious archive.

• Victim interactionNot required

  No user action is needed beyond the service's normal operation; the CVSS vector specifies UI:N, so exploitation is fully attacker-driven.

• Attack complexityDetail

  Attack complexity is Low (AC:L), meaning the exploit is reliable and repeatable with no race conditions or special environmental prerequisites.

Blast Radius

• The attacker writes arbitrary files to any path on the host filesystem that the process running ocaml-tar has write permission to.
• Writes to executable locations (init scripts, cron jobs, application binaries) can lead to remote code execution on the host.
• Writes to configuration or credential files can expose secrets, overwrite access-control rules, or alter application behavior persistently.
• Confidential data already stored on the filesystem is at risk of being overwritten or corrupted, causing integrity loss across any data the process can reach.