Skip to content
snailsploit[$]
live
Home/Research/CVEs/CVE-2026-32809 | Symlink Resolution Bypass in ouch
2 min read

CVE-2026-32809 | Symlink Resolution Bypass in ouch

CVE-2026-32809: Unvalidated symlink targets in ouch tar extraction enable arbitrary file read via crafted archives. Affects all tar formats. CVSS 7.4.

TL;DR
A symlink resolution vulnerability was discovered inouch, a Rust-based compression and decompression tool. Thecreate_symlink()function insrc/utils/fs.rsaccepts user-controlled symlink destinations from tar archives without any sanitization or validation.
CVE Disclosures →

Description

A symlink resolution vulnerability was discovered in ouch, a Rust-based compression and decompression tool. The create_symlink() function in src/utils/fs.rs accepts user-controlled symlink destinations from tar archives without any sanitization or validation.

While regular file extraction undergoes path validation via the tar-rs library, symlink targets bypass these checks entirely. No absolute path checks, traversal prevention, or containment verification are performed on symlink destinations.

Technical Details

Root Cause

The create_symlink() function trusts the symlink target path from the archive entry directly. Unlike regular files which undergo extraction path validation through tar-rs, symlinks are created with whatever target the archive specifies — including paths outside the extraction directory.

Affected Archive Formats

All tar-based formats handled by ouch are affected:

  • .tar, .tar.gz, .tar.bz2, .tar.xz
  • .tar.lz4, .tar.lzma, .tar.sz, .tar.zst

Attack Scenario

An attacker crafts a malicious tar archive containing symlinks pointing to sensitive files such as SSH keys (~/.ssh/id_rsa), AWS credentials (~/.aws/credentials), or system files (/etc/shadow). When a victim decompresses the archive using ouch, the symlinks are created, allowing the attacker to read arbitrary files through subsequent archive operations or file access.

Vulnerability Characteristics

  • Attack Vector: Network — malicious archive distribution
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required — victim must decompress the archive
  • Scope: Changed — symlinks can reach files outside the extraction context

Impact Assessment

  • Confidentiality: High — arbitrary file read via symlink resolution
  • Integrity: None
  • Availability: None

The changed scope and high confidentiality impact result in a CVSS 7.4 (High) rating. Credential theft and sensitive data exposure are the primary risks.

Disclosure Timeline

  • 2026-03-15: Vulnerability reported via GitHub Private Vulnerability Reporting
  • 2026-03-16: CVE-2026-32809 assigned (GHSA-pcw6-cg54-qvm8)

Remediation

No patched version is available yet. Avoid decompressing untrusted tar archives with ouch until a fix is released. Consider using alternative extraction tools that validate symlink targets.

Discovered by: Kai Aizen (SnailSploit)

Related
2026-03-11
Linux Kernel io_uring/zcrx: Race Condition to Double-Free
Race condition in io_uring zerocopy receive (zcrx) — non-atomic user_refs operations cause double-free and out-of-bounds write. Kernel fix b…
2025-08-09
Zero-Trust Container Runtime Attestation
Implementing zero-trust principles in container runtime environments. Runtime attestation strategies, security architecture, and hardening t…
2025-03-02
Advanced Container Escapes: Security Deep Dive
Deep technical analysis of container escape techniques — namespace breakouts, capability abuse, kernel exploits, and principle-based prevent…
cite this work
BibTeX 
@misc{aizen2026cve,
  author = {Aizen, Kai},
  title  = {CVE-2026-32809 | Symlink Resolution Bypass in ouch},
  year   = {2026},
  url    = {https://snailsploit.com/security-research/cves/cve-2026-32809/},
  note   = {snailsploit.com}
}
APA

Aizen, K. (2026). CVE-2026-32809 | Symlink Resolution Bypass in ouch. snailsploit.com. https://snailsploit.com/security-research/cves/cve-2026-32809/

MLA

Aizen, Kai. "CVE-2026-32809 | Symlink Resolution Bypass in ouch." snailsploit, 2026, https://snailsploit.com/security-research/cves/cve-2026-32809/.

Chicago

Aizen, Kai. "CVE-2026-32809 | Symlink Resolution Bypass in ouch." snailsploit (blog). 2026. https://snailsploit.com/security-research/cves/cve-2026-32809/.

Permalink: https://snailsploit.com/security-research/cves/cve-2026-32809/
disclosure context
all disclosures
CVE Ledger →
79 published CVEs across container, web, OSS, kernel
advisories
GHSA disclosures →
coordinated security advisories
engage
Pen Testing →
same methodology, your stack
Author
Kai Aizen
Independent Adversarial · Research group. 79 published CVEs, 5 Linux kernel mainline patches, creator of AATMF / P.R.O.M.P.T / SEF, author of Adversarial Minds.
aboutservicesresearchgate
Quick facts
ID
CVE-2026-32809
Product
ouch
Severity
— · Pending
Class
Symlink Resolution Bypass
References: NVD · MITRE · snailsploit CVE ledger
Frequently asked

CVE-2026-32809 — questions & answers

What is CVE-2026-32809?

CVE-2026-32809 is a disclosed vulnerability (Symlink Resolution Bypass) in ouch, coordinated through the standard CVE process by independent security researcher Kai Aizen.

Am I affected by CVE-2026-32809?

You are affected if your environment runs an unpatched version of ouch. Check the upstream advisory or NVD record for the precise affected version range, then verify against your deployed version.

How do I fix CVE-2026-32809?

Upgrade ouch to the version that includes the upstream fix referenced in the NVD record. If an immediate upgrade is not possible, apply the mitigation guidance from the vendor advisory and restrict exposure of the affected surface area.

What is the impact of CVE-2026-32809?

CVSS — · Pending. The vulnerability class is Symlink Resolution Bypass; consult the NVD and vendor advisory for vector details, exploitation prerequisites, and observed impact.

Where can I find authoritative references?

NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-32809, the MITRE CVE record at https://www.cve.org/CVERecord?id=CVE-2026-32809, and the vendor's security advisory page.