Vulnerability-Lookup

RHSA-2026:61581

Vulnerability from csaf_redhat - Published: 2026-08-31 14:39 - Updated: 2026-09-01 11:15

Summary

Red Hat Security Advisory: tar security, bug fix, and enhancement update

Severity

Moderate

Notes

Topic: An update for tar is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The GNU tar program can save multiple files in an archive and restore files from an archive. Security Fix(es): * tar: tar: Hidden file injection via crafted archives (CVE-2026-5704) * tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape (CVE-2026-18477) * tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite (CVE-2026-18508) Bug Fix(es) and Enhancement(s): * tar: --one-top-level with absolute path fails [rhel-9] (JIRA:RHEL-144021) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-5704

A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.

5.0 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

CWE-434 - Unrestricted Upload of File with Dangerous Type

Affected products

Fixed 13 products

Product	Version	Remediation
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.src	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-18477

A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue.

4.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

Affected products

Fixed 13 products

Product	Version	Remediation
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.src	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-18508

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.

4.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Affected products

Fixed 13 products

Product	Version	Remediation
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.src	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

References

18 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:61581	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2455360	external
https://bugzilla.redhat.com/show_bug.cgi?id=2509735	external
https://bugzilla.redhat.com/show_bug.cgi?id=2509843	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-5704	self
https://bugzilla.redhat.com/show_bug.cgi?id=2455360	external
https://www.cve.org/CVERecord?id=CVE-2026-5704	external
https://nvd.nist.gov/vuln/detail/CVE-2026-5704	external
https://access.redhat.com/security/cve/CVE-2026-18477	self
https://bugzilla.redhat.com/show_bug.cgi?id=2509735	external
https://www.cve.org/CVERecord?id=CVE-2026-18477	external
https://nvd.nist.gov/vuln/detail/CVE-2026-18477	external
https://access.redhat.com/security/cve/CVE-2026-18508	self
https://bugzilla.redhat.com/show_bug.cgi?id=2509843	external
https://www.cve.org/CVERecord?id=CVE-2026-18508	external
https://nvd.nist.gov/vuln/detail/CVE-2026-18508	external

Acknowledgments

Guillermo de Angel Garcia

AFINE Team Michał Majchrowicz Marcin Wyczechowski

Red Hat Pavel Cahyna

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for tar is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The GNU tar program can save multiple files in an archive and restore files from an archive.\n\nSecurity Fix(es):\n\n* tar: tar: Hidden file injection via crafted archives (CVE-2026-5704)\n\n* tar: tar: TOCTOU in incremental dumpdir \u0027X\u0027 rename handling allows restore path escape (CVE-2026-18477)\n\n* tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite (CVE-2026-18508)\n\nBug Fix(es) and Enhancement(s):\n\n* tar: --one-top-level with absolute path fails [rhel-9] (JIRA:RHEL-144021)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:61581",
        "url": "https://access.redhat.com/errata/RHSA-2026:61581"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2455360",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455360"
      },
      {
        "category": "external",
        "summary": "2509735",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509735"
      },
      {
        "category": "external",
        "summary": "2509843",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509843"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61581.json"
      }
    ],
    "title": "Red Hat Security Advisory: tar security, bug fix, and enhancement update",
    "tracking": {
      "current_release_date": "2026-09-01T11:15:51+00:00",
      "generator": {
        "date": "2026-09-01T11:15:51+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:61581",
      "initial_release_date": "2026-08-31T14:39:25+00:00",
      "revision_history": [
        {
          "date": "2026-08-31T14:39:25+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-31T14:39:25+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-01T11:15:51+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux BaseOS (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux BaseOS (v. 9)",
                  "product_id": "BaseOS-9.8.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:9::baseos"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tar-2:1.34-13.el9_8.src",
                "product": {
                  "name": "tar-2:1.34-13.el9_8.src",
                  "product_id": "tar-2:1.34-13.el9_8.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tar@1.34-13.el9_8?arch=src\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tar-2:1.34-13.el9_8.aarch64",
                "product": {
                  "name": "tar-2:1.34-13.el9_8.aarch64",
                  "product_id": "tar-2:1.34-13.el9_8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tar@1.34-13.el9_8?arch=aarch64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tar-debugsource-2:1.34-13.el9_8.aarch64",
                "product": {
                  "name": "tar-debugsource-2:1.34-13.el9_8.aarch64",
                  "product_id": "tar-debugsource-2:1.34-13.el9_8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tar-debugsource@1.34-13.el9_8?arch=aarch64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tar-debuginfo-2:1.34-13.el9_8.aarch64",
                "product": {
                  "name": "tar-debuginfo-2:1.34-13.el9_8.aarch64",
                  "product_id": "tar-debuginfo-2:1.34-13.el9_8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tar-debuginfo@1.34-13.el9_8?arch=aarch64\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tar-2:1.34-13.el9_8.ppc64le",
                "product": {
                  "name": "tar-2:1.34-13.el9_8.ppc64le",
                  "product_id": "tar-2:1.34-13.el9_8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tar@1.34-13.el9_8?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tar-debugsource-2:1.34-13.el9_8.ppc64le",
                "product": {
                  "name": "tar-debugsource-2:1.34-13.el9_8.ppc64le",
                  "product_id": "tar-debugsource-2:1.34-13.el9_8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tar-debugsource@1.34-13.el9_8?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tar-debuginfo-2:1.34-13.el9_8.ppc64le",
                "product": {
                  "name": "tar-debuginfo-2:1.34-13.el9_8.ppc64le",
                  "product_id": "tar-debuginfo-2:1.34-13.el9_8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tar-debuginfo@1.34-13.el9_8?arch=ppc64le\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tar-2:1.34-13.el9_8.s390x",
                "product": {
                  "name": "tar-2:1.34-13.el9_8.s390x",
                  "product_id": "tar-2:1.34-13.el9_8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tar@1.34-13.el9_8?arch=s390x\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tar-debugsource-2:1.34-13.el9_8.s390x",
                "product": {
                  "name": "tar-debugsource-2:1.34-13.el9_8.s390x",
                  "product_id": "tar-debugsource-2:1.34-13.el9_8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tar-debugsource@1.34-13.el9_8?arch=s390x\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tar-debuginfo-2:1.34-13.el9_8.s390x",
                "product": {
                  "name": "tar-debuginfo-2:1.34-13.el9_8.s390x",
                  "product_id": "tar-debuginfo-2:1.34-13.el9_8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tar-debuginfo@1.34-13.el9_8?arch=s390x\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tar-2:1.34-13.el9_8.x86_64",
                "product": {
                  "name": "tar-2:1.34-13.el9_8.x86_64",
                  "product_id": "tar-2:1.34-13.el9_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tar@1.34-13.el9_8?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tar-debugsource-2:1.34-13.el9_8.x86_64",
                "product": {
                  "name": "tar-debugsource-2:1.34-13.el9_8.x86_64",
                  "product_id": "tar-debugsource-2:1.34-13.el9_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tar-debugsource@1.34-13.el9_8?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tar-debuginfo-2:1.34-13.el9_8.x86_64",
                "product": {
                  "name": "tar-debuginfo-2:1.34-13.el9_8.x86_64",
                  "product_id": "tar-debuginfo-2:1.34-13.el9_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tar-debuginfo@1.34-13.el9_8?arch=x86_64\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tar-2:1.34-13.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.aarch64"
        },
        "product_reference": "tar-2:1.34-13.el9_8.aarch64",
        "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tar-2:1.34-13.el9_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.ppc64le"
        },
        "product_reference": "tar-2:1.34-13.el9_8.ppc64le",
        "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tar-2:1.34-13.el9_8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.s390x"
        },
        "product_reference": "tar-2:1.34-13.el9_8.s390x",
        "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tar-2:1.34-13.el9_8.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.src"
        },
        "product_reference": "tar-2:1.34-13.el9_8.src",
        "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tar-2:1.34-13.el9_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.x86_64"
        },
        "product_reference": "tar-2:1.34-13.el9_8.x86_64",
        "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tar-debuginfo-2:1.34-13.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.aarch64"
        },
        "product_reference": "tar-debuginfo-2:1.34-13.el9_8.aarch64",
        "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tar-debuginfo-2:1.34-13.el9_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.ppc64le"
        },
        "product_reference": "tar-debuginfo-2:1.34-13.el9_8.ppc64le",
        "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tar-debuginfo-2:1.34-13.el9_8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.s390x"
        },
        "product_reference": "tar-debuginfo-2:1.34-13.el9_8.s390x",
        "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tar-debuginfo-2:1.34-13.el9_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.x86_64"
        },
        "product_reference": "tar-debuginfo-2:1.34-13.el9_8.x86_64",
        "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tar-debugsource-2:1.34-13.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.aarch64"
        },
        "product_reference": "tar-debugsource-2:1.34-13.el9_8.aarch64",
        "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tar-debugsource-2:1.34-13.el9_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.ppc64le"
        },
        "product_reference": "tar-debugsource-2:1.34-13.el9_8.ppc64le",
        "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tar-debugsource-2:1.34-13.el9_8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.s390x"
        },
        "product_reference": "tar-debugsource-2:1.34-13.el9_8.s390x",
        "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tar-debugsource-2:1.34-13.el9_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.x86_64"
        },
        "product_reference": "tar-debugsource-2:1.34-13.el9_8.x86_64",
        "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Guillermo de Angel Garcia"
          ]
        }
      ],
      "cve": "CVE-2026-5704",
      "cwe": {
        "id": "CWE-434",
        "name": "Unrestricted Upload of File with Dangerous Type"
      },
      "discovery_date": "2026-04-06T13:36:20+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2455360"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tar: tar: Hidden file injection via crafted archives",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.aarch64",
          "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.ppc64le",
          "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.s390x",
          "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.src",
          "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.x86_64",
          "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.aarch64",
          "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.ppc64le",
          "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.s390x",
          "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.x86_64",
          "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.aarch64",
          "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.ppc64le",
          "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.s390x",
          "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-5704"
        },
        {
          "category": "external",
          "summary": "RHBZ#2455360",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455360"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-5704",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-5704"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5704",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5704"
        }
      ],
      "release_date": "2026-04-06T13:36:20+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-31T14:39:25+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.src",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:61581"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, avoid extracting archives from untrusted sources. If processing untrusted archives is necessary, do so within a sandboxed environment to limit potential impact.",
          "product_ids": [
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.src",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.src",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tar: tar: Hidden file injection via crafted archives"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Micha\u0142 Majchrowicz",
            "Marcin Wyczechowski"
          ],
          "organization": "AFINE Team"
        }
      ],
      "cve": "CVE-2026-18477",
      "cwe": {
        "id": "CWE-367",
        "name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
      },
      "discovery_date": "2026-07-31T10:48:52.898000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509735"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar\u0027s incremental dumpdir \u0027X\u0027 rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows\u2014including extracting into a newly created directory without using the -P option do not mitigate the issue.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tar: tar: TOCTOU in incremental dumpdir \u0027X\u0027 rename handling allows restore path escape",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue affects GNU tar incremental backup and restore (-g/-G). A local attacker who can write to content included in an incremental backup, and who can also access the system where that backup is later restored, may cause the restore to create, rename, or overwrite paths outside the intended extraction directory via a TOCTOU race in dumpdir \u0027X\u0027 handling. The attacker does not need to craft or alter the archive, and extracting it into a fresh directory does not mitigate the issue. Red Hat is assessing impact for the tar package in supported products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.aarch64",
          "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.ppc64le",
          "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.s390x",
          "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.src",
          "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.x86_64",
          "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.aarch64",
          "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.ppc64le",
          "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.s390x",
          "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.x86_64",
          "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.aarch64",
          "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.ppc64le",
          "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.s390x",
          "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-18477"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509735",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509735"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-18477",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-18477"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-18477",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18477"
        }
      ],
      "release_date": "2026-07-31T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-31T14:39:25+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.src",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:61581"
        },
        {
          "category": "workaround",
          "details": "Do not perform incremental restores (-G/-g) from untrusted archives. Avoid restoring incremental backups on systems where untrusted users have shell access,\u200b perform restoration only on systems inaccessible to users.",
          "product_ids": [
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.src",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.src",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tar: tar: TOCTOU in incremental dumpdir \u0027X\u0027 rename handling allows restore path escape"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Pavel Cahyna"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2026-18508",
      "cwe": {
        "id": "CWE-59",
        "name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
      },
      "discovery_date": "2026-07-31T16:57:51.102000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509843"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Enterprise Linux is affected. This issue only applies when the --one-top-level option is used to extract an untrusted archive. Default tar extraction without --one-top-level is not impacted by this specific boundary failure. Users should avoid using --one-top-level as the sole confinement mechanism for untrusted archives until fixed packages are available.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.aarch64",
          "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.ppc64le",
          "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.s390x",
          "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.src",
          "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.x86_64",
          "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.aarch64",
          "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.ppc64le",
          "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.s390x",
          "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.x86_64",
          "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.aarch64",
          "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.ppc64le",
          "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.s390x",
          "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-18508"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509843",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509843"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-18508",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-18508"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-18508",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18508"
        }
      ],
      "release_date": "2026-07-31T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-31T14:39:25+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.src",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:61581"
        },
        {
          "category": "workaround",
          "details": "Do not use --one-top-level as the sole confinement mechanism when extracting untrusted archives. Prefer extracting as an unprivileged user into a freshly created empty directory after changing into that directory (mkdir and cd), avoid extracting as root from sensitive working directories such as /, and follow the GNU tar security guidance for untrusted archives.",
          "product_ids": [
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.src",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.src",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-2:1.34-13.el9_8.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debuginfo-2:1.34-13.el9_8.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:tar-debugsource-2:1.34-13.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite"
    }
  ]
}

CVE-2026-18477 (GCVE-0-2026-18477)

Vulnerability from cvelistv5 – Published: 2026-08-03 15:34 – Updated: 2026-09-01 11:09

Title

Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape

Summary

Severity

4.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 16:25 UTC

CWE

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

Assigner

redhat redhat root

References

5 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:49361	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:61581	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:61783	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-18477	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2509735	issue-trackingx_refsource_REDHAT

Impacted products

9 products

Vendor	Product	Version
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 2:1.34-13.el9_8 , < * (rpm) cpe:/o:redhat:enterprise_linux:9::baseos
Red Hat	Red Hat Discovery 2	Unaffected: 1788205779 , < * (rpm) cpe:/a:redhat:discovery:2::el9
Red Hat	Red Hat Hardened Images	Unaffected: 1.35-9.1.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Hardened Images	cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4

Date Public

2026-07-31 00:00

Credits

Red Hat would like to thank Marcin Wyczechowski (AFINE Team) and Michał Majchrowicz (AFINE Team) for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18477",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T16:25:22.002230Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T16:26:49.498Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "tar",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:1.34-13.el9_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:discovery:2::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "discovery/discovery-server-rhel9",
          "product": "Red Hat Discovery 2",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1788205779",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "tar-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1.35-9.1.hum1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "tar",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "tar",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "unknown",
          "packageName": "tar",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "tar",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "unaffected",
          "packageName": "aardvark-dns",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "unaffected",
          "packageName": "chunkah",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "unaffected",
          "packageName": "grafana12.4",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "unaffected",
          "packageName": "grafana13.1",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "unaffected",
          "packageName": "netavark",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "unaffected",
          "packageName": "nodejs26",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "unaffected",
          "packageName": "python-cryptography",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rust",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rust-rpm-sequoia",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "unaffected",
          "packageName": "yarnpkg",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift/ose-rhel-coreos-8",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift/ose-rhel-coreos-9",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Marcin Wyczechowski (AFINE Team) and Micha\u0142 Majchrowicz (AFINE Team) for reporting this issue."
        }
      ],
      "datePublic": "2026-07-31T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar\u0027s incremental dumpdir \u0027X\u0027 rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows\u2014including extracting into a newly created directory without using the -P option do not mitigate the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "Time-of-check Time-of-use (TOCTOU) Race Condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T11:09:40.128Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:49361",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:49361"
        },
        {
          "name": "RHSA-2026:61581",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:61581"
        },
        {
          "name": "RHSA-2026:61783",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:61783"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-18477"
        },
        {
          "name": "RHBZ#2509735",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509735"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-31T10:48:52.898Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-07-31T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Tar: tar: toctou in incremental dumpdir \u0027x\u0027 rename handling allows restore path escape",
      "workarounds": [
        {
          "lang": "en",
          "value": "Do not perform incremental restores (-G/-g) from untrusted archives. Avoid restoring incremental backups on systems where untrusted users have shell access,\u200b perform restoration only on systems inaccessible to users."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-18477",
    "datePublished": "2026-08-03T15:34:36.627Z",
    "dateReserved": "2026-07-31T10:48:40.556Z",
    "dateUpdated": "2026-09-01T11:09:40.128Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-18508 (GCVE-0-2026-18508)

Vulnerability from cvelistv5 – Published: 2026-08-03 14:51 – Updated: 2026-09-01 12:48

Title

Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite

Summary

Severity

4.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 16:02 UTC

CWE

CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Assigner

redhat redhat root

References

5 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:50807	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:61581	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:61783	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-18508	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2509843	issue-trackingx_refsource_REDHAT

Impacted products

9 products

Vendor	Product	Version
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 2:1.34-13.el9_8 , < * (rpm) cpe:/o:redhat:enterprise_linux:9::baseos
Red Hat	Red Hat Discovery 2	Unaffected: 1788205779 , < * (rpm) cpe:/a:redhat:discovery:2::el9
Red Hat	Red Hat Hardened Images	Unaffected: 1.35-9.2.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Hardened Images	cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4

Date Public

2026-07-31 00:00

Credits

This issue was discovered by Pavel Cahyna (Red Hat).

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18508",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T16:02:27.313193Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T16:06:11.931Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "tar",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:1.34-13.el9_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:discovery:2::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "discovery/discovery-server-rhel9",
          "product": "Red Hat Discovery 2",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1788205779",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "tar-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1.35-9.2.hum1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "tar",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "tar",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "unknown",
          "packageName": "tar",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "tar",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "unaffected",
          "packageName": "aardvark-dns",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "unaffected",
          "packageName": "chunkah",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "unaffected",
          "packageName": "grafana12.4",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "unaffected",
          "packageName": "grafana13.1",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "unaffected",
          "packageName": "netavark",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "unaffected",
          "packageName": "nodejs26",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "unaffected",
          "packageName": "python-cryptography",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rust",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rust-rpm-sequoia",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "unaffected",
          "packageName": "yarnpkg",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift/ose-rhel-coreos-8",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift/ose-rhel-coreos-9",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "This issue was discovered by Pavel Cahyna (Red Hat)."
        }
      ],
      "datePublic": "2026-07-31T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T12:48:05.411Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:50807",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:50807"
        },
        {
          "name": "RHSA-2026:61581",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:61581"
        },
        {
          "name": "RHSA-2026:61783",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:61783"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-18508"
        },
        {
          "name": "RHBZ#2509843",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509843"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-31T16:57:51.102Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-07-31T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite",
      "workarounds": [
        {
          "lang": "en",
          "value": "Do not use --one-top-level as the sole confinement mechanism when extracting untrusted archives. Prefer extracting as an unprivileged user into a freshly created empty directory after changing into that directory (mkdir and cd), avoid extracting as root from sensitive working directories such as /, and follow the GNU tar security guidance for untrusted archives."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-18508",
    "datePublished": "2026-08-03T14:51:41.340Z",
    "dateReserved": "2026-07-31T17:08:04.550Z",
    "dateUpdated": "2026-09-01T12:48:05.411Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-5704 (GCVE-0-2026-5704)

Vulnerability from cvelistv5 – Published: 2026-04-06 15:17 – Updated: 2026-09-01 02:19

Title

Tar: tar: hidden file injection via crafted archives

Summary

Severity

5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-07 15:48 UTC

CWE

CWE-434 - Unrestricted Upload of File with Dangerous Type

Assigner

redhat redhat root

References

7 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:61581	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:61783	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-5704	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2455360	issue-trackingx_refsource_REDHAT
http://www.openwall.com/lists/oss-security/2026/0…
http://www.openwall.com/lists/oss-security/2026/0…
http://www.openwall.com/lists/oss-security/2026/04/12/2

Impacted products

7 products

Vendor	Product	Version
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 2:1.34-13.el9_8 , < * (rpm) cpe:/o:redhat:enterprise_linux:9::baseos
Red Hat	Red Hat Discovery 2	Unaffected: 1788205779 , < * (rpm) cpe:/a:redhat:discovery:2::el9
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Hardened Images	cpe:/a:redhat:hummingbird:1

Date Public

2026-04-06 13:36

Credits

Red Hat would like to thank Guillermo de Angel Garcia for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-5704",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-07T15:48:15.196926Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-07T16:01:07.180Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-04-12T04:57:27.544Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/04/11/10"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/04/11/11"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/04/12/2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "tar",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:1.34-13.el9_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:discovery:2::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "discovery/discovery-server-rhel9",
          "product": "Red Hat Discovery 2",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1788205779",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "tar",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "affected",
          "packageName": "tar",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "tar",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "tar",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "tar",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Guillermo de Angel Garcia for reporting this issue."
        }
      ],
      "datePublic": "2026-04-06T13:36:20.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T02:19:55.830Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:61581",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:61581"
        },
        {
          "name": "RHSA-2026:61783",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:61783"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-5704"
        },
        {
          "name": "RHBZ#2455360",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455360"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-06T13:36:20.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-04-06T13:36:20.000Z",
          "value": "Made public."
        }
      ],
      "title": "Tar: tar: hidden file injection via crafted archives",
      "workarounds": [
        {
          "lang": "en",
          "value": "To mitigate this issue, avoid extracting archives from untrusted sources. If processing untrusted archives is necessary, do so within a sandboxed environment to limit potential impact."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-434: Unrestricted Upload of File with Dangerous Type"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-5704",
    "datePublished": "2026-04-06T15:17:27.945Z",
    "dateReserved": "2026-04-06T13:37:17.528Z",
    "dateUpdated": "2026-09-01T02:19:55.830Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

RHSA-2026:61581

CVE-2026-18477 (GCVE-0-2026-18477)

CVE-2026-18508 (GCVE-0-2026-18508)

CVE-2026-5704 (GCVE-0-2026-5704)

Tags

Sightings

Nomenclature