by Kastro CVE-2026-42496
BINGOS Archive::Tar — Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory
Description · from the CVE record
Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target. A subsequent open through the extracted name reads or writes the attacker chosen path.
Affected
ProductAffectedFixed inSource
Archive::Tar< 3.083.08CNA
Red Hat Enterprise Linux 10see advisory0:3.02-512.el10_2.1redhat-SADP
Red Hat Enterprise Linux 8see advisory8100020260616084412.651ee29fredhat-SADP
Red Hat Enterprise Linux 8see advisory0:2.30-2.el8_10redhat-SADP
Red Hat Enterprise Linux 9see advisory0:2.38-6.el9_8.1redhat-SADP
Red Hat Enterprise Linux 7see advisory–redhat-SADP
Scores by source
CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
redhat-SADP (CNA)8.2CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial