{"vulnerability": "cve-2026-42496", "sightings": [{"uuid": "b038f35c-275c-4c63-8aa6-5ea7d6628d66", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-42496", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mmqcvf2y2s26", "content": "Symlink vuln (HIGH) in BINGOS Archive::Tar <3.08: attackers can escape extraction dirs for unauthorized file access. No patch yet \u2014 avoid untrusted tar files. Full details: https://radar.offseq.com/threat/cve-2026-42496-cwe-59-improper-link-resolution-bef-ae924259 #OffSeq #vuln #infosec", "creation_timestamp": "2026-05-26T06:00:37.352053Z"}, {"uuid": "1842dca3-967f-48d4-90bf-aa52d7960cd5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42496", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mmqmdp566n25", "content": "CVE-2026-42496: Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory", "creation_timestamp": "2026-05-26T08:49:40.075365Z"}, {"uuid": "dc876ac8-040d-47e0-85ec-708dc41d505b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42496", "type": "seen", "source": "https://bsky.app/profile/securitycyberuk.bsky.social/post/3motmrathgt2r", "content": "\ud83d\udea8  ALERT: CVE-2026-42496\n\nCVSS 9.1/10\n\n\ud83d\udccb WHAT IT IS:\nArchive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. s", "creation_timestamp": "2026-06-22T00:26:01.719855Z"}, {"uuid": "a33dd92f-4f07-4ac5-ad7c-944d0de44976", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42496", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mpywt27xh32s", "content": "CVE-2026-42496 - rootio-perl\nThe rootio-perl package in Debian 12 had a security issue that allowed unauthorized access to sensitive information. This has been fixed by Root in a recent update, and\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#rootioperl #RootDebian12 #CVE #infosec", "creation_timestamp": "2026-07-06T20:34:05.614362Z"}, {"uuid": "521a123e-7f0b-45d2-b77d-87e58f235cad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42496", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mqp5ww6arr2m", "content": "Yes Critical (9.1) CVE-2026-39831 Yes Yes Yes Yes Critical (9.1) CVE-2026-39832 Yes Yes Yes Yes Critical (9.1) CVE-2026-39833 Yes Yes Yes Yes Critical (9.1) CVE-2026-39834 Yes Yes Yes Yes Critical (9.1) CVE-2026-42496 Yes Yes No Yes Medium (9.1) CVE-2026-42508 Yes Yes Yes", "creation_timestamp": "2026-07-15T16:40:08.394683Z"}, {"uuid": "f9156fcc-f2a3-4fb9-b70a-84b19ec45bef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42496", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqreadi3ts2w", "content": "CVE-2026-42496 - rootio-perl\nA security patch has been released for the rootio-perl package on Root:Debian:13. This patch addresses a vulnerability that could allow unauthorized access to sensitive\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#rootioperl #RootDebian13 #CVE #infosec", "creation_timestamp": "2026-07-16T13:38:03.450985Z"}, {"uuid": "b3aaaa6f-fe30-4d0a-aadc-56fab3805c1a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42496", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqtt56zgi62l", "content": "CVE-2026-42496 - rootio-perl\nA security patch has been released for the rootio-perl package in Root:Debian:11. This patch fixes a vulnerability that could allow unauthorized access to the system if\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#rootioperl #RootDebian11 #CVE #infosec", "creation_timestamp": "2026-07-17T13:10:04.063620Z"}]}