UpHeron
All vulnerabilities

Servers and applications

CVE-2022-21658

Race condition in std::fs::remove_dir_all

Severity
Medium 6.3
Published
20 Jan 2022
Last changed
17 Jun 2026
Added to UpHeron
22 Oct 2026
Also known as
GHSA-r9cc-f5pr-p3j2
Sources
NVD, Project advisories (GitHub)

Description

Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the `std::fs::remove_dir_all` standard library function is vulnerable a race condition enabling symlink following (CWE-363). An attacker could use this security issue to trick a privileged program into deleting files and…

Affected software

SoftwareAffected versions
RustServers and applications · cpe:a:rust-lang:rust
  • From 1.0.0 up to 1.58.0
RustServers and applications · github:rust-lang/rust
  • Every version up to 1.58.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-21658
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-21658
  • GitHub Advisory Database https://github.com/advisories/GHSA-r9cc-f5pr-p3j2
  • github.com https://github.com/rust-lang/rust/security/advisories/GHSA-r9cc-f5pr-p3j2