Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Microsoft.NETCore.App.Runtime.linux-x64 | nuget | >= 8.0.0, <= 8.0.27 | 8.0.28 |
| Microsoft.NETCore.App.Runtime.linux-x64 | nuget | >= 9.0.0, <= 9.0.16 | 9.0.17 |
| Microsoft.NETCore.App.Runtime.linux-x64 | nuget | >= 10.0.0, <= 10.0.8 | 10.0.9 |
| Microsoft.NETCore.App.Runtime.win-x64 | nuget | >= 8.0.0, <= 8.0.27 | 8.0.28 |
| Microsoft.NETCore.App.Runtime.win-x64 | nuget | >= 9.0.0, <= 9.0.16 | 9.0.17 |
| Microsoft.NETCore.App.Runtime.win-x64 | nuget | >= 10.0.0, <= 10.0.8 | 10.0.9 |
| Microsoft.NETCore.App.Runtime.osx-arm64 | nuget | >= 8.0.0, <= 8.0.27 | 8.0.28 |
| Microsoft.NETCore.App.Runtime.osx-arm64 | nuget | >= 9.0.0, <= 9.0.16 | 9.0.17 |
| Microsoft.NETCore.App.Runtime.osx-arm64 | nuget | >= 10.0.0, <= 10.0.8 | 10.0.9 |
Miggo AIRoot Cause AnalysisThe vulnerability is a path traversal issue in the .NET System.Formats.Tar library, specifically within the TarFile.ExtractToDirectory method. An attacker can craft a TAR archive containing a symbolic link that points to a location outside of the intended extraction directory. When the vulnerable version of the library attempts to extract this archive, it follows the symbolic link, allowing the attacker to write files to arbitrary locations on the filesystem.
The patch addresses this vulnerability by introducing new validation logic. The core of the fix is in the System.Formats.Tar.TarEntry.ExtractRelativeToDirectoryAsync method, which is called internally by TarFile.ExtractToDirectory. The patch adds a call to a new method, FilePathEscapesDirectory, which resolves the real path of the file to be extracted, including any symbolic links, and checks if the final path is within the boundaries of the destination directory. If a path traversal is detected, an IOException is thrown, preventing the malicious file from being written.
The identified vulnerable functions are System.Formats.Tar.TarFile.ExtractToDirectory, as it is the public entry point for the vulnerable operation, and System.Formats.Tar.TarEntry.ExtractRelativeToDirectoryAsync, which contains the flawed logic that was fixed by the patch.
System.Formats.Tar.TarEntry.ExtractRelativeToDirectoryAsyncsrc/libraries/System.Formats.Tar/src/System/Formats/Tar/TarEntry.cs
System.Formats.Tar.TarFile.ExtractToDirectorysrc/libraries/System.Formats.Tar/src/System/Formats/Tar/TarFile.cs