---
id: CVE-2021-31566
title: >-
  An improper link resolution flaw can occur while extracting an archive leading
  to changing modes, times, access control lists, and flags of a file outside of
  the archive
summary: >-
  An improper link resolution flaw can occur while extracting an archive leading
  to changing modes, times, access control lists, and flags of a file outside of
  the archive. An attacker may provide a malicious archive to a victim user, who
  …
severity: none
cwe:
  - CWE-59
product: libarchive
affected:
  - libarchive Fixed in libarchive 3.5.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-02T18:01:56.778160Z'
published: '2022-08-23'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T18:02:14.581Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2021-31566'
references:
  - url: 'https://github.com/libarchive/libarchive/issues/1566'
  - url: >-
      https://github.com/libarchive/libarchive/commit/b41daecb5ccb4c8e3b2c53fd6147109fc12c3043
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2024237'
  - url: 'https://access.redhat.com/security/cve/CVE-2021-31566'
  - url: 'https://lists.debian.org/debian-lts-announce/2022/11/msg00030.html'
    label: >-
      [debian-lts-announce] 20221122 [SECURITY] [DLA 3202-1] libarchive security
      update
tags:
  - cve.org
epss: 0.0039
epssPercentile: 0.33385
ingestedAt: '2026-11-05T19:30:42.762Z'
---

## Overview

An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of the archive. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. A local attacker may use this flaw to gain more privileges in a system.

## Affected

- `libarchive Fixed in libarchive 3.5.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.