Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory
Summary
| CVE | CVE-2026-42496 |
|---|---|
| State | PUBLISHED |
| Assigner | CPANSec |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-05-26 02:16:40 UTC |
| Updated | 2026-07-15 02:21:32 UTC |
| Description | Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target. A subsequent open through the extracted name reads or writes the attacker chosen path. |
Risk And Classification
Primary CVSS: v3.1 9.1 CRITICAL from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS: 0.004300000 probability, percentile 0.348600000 (date 2026-07-18)
Problem Types: CWE-59 | CWE-22 | CWE-59 CWE-59 Improper Link Resolution Before File Access ('Link Following') | CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 9.1 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| 3.1 | ADP | DECLARED | 9.1 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| 3.1 | ADP | CVSS | 8.2 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H |
| 3.1 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary | 9.1 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| 3.1 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | Secondary | 8.2 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Archive | tar_project | archive\ | \ | tar |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | BINGOS | ArchiveTar | affected 3.08 custom | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 10 | unaffected 0:3.02-512.el10_2.1 * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 8 | unaffected 8100020260616084412.651ee29f * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 8 | unaffected 0:2.30-2.el8_10 * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 9 | unaffected 0:2.38-6.el9_8.1 * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 7 | Not specified | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42496.json | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | security.access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:30851 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:30856 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| metacpan.org/release/BINGOS/Archive-Tar-3.08/changes | 9b29abf9-4ab0-4765-b253-1875cd9b441e | metacpan.org | Release Notes |
| access.redhat.com/errata/RHSA-2026:30857 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:30852 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| www.cve.org/CVERecord | 9b29abf9-4ab0-4765-b253-1875cd9b441e | www.cve.org | Third Party Advisory |
| access.redhat.com/security/cve/CVE-2026-42496 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| bugzilla.redhat.com/show_bug.cgi | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | bugzilla.redhat.com | |
| github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd... | 9b29abf9-4ab0-4765-b253-1875cd9b441e | github.com | Patch |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-04-12T00:00:00.000Z | Issue reported. |
| CNA | 2026-05-22T00:00:00.000Z | Version 3.08 released. |
| ADP | 2026-05-26T02:00:52.414Z | Reported to Red Hat. |
| ADP | 2026-05-26T00:17:19.110Z | Made public. |
Solutions
CNA: Upgrade to Archive::Tar 3.08 or later.
ADP: RHSA-2026:30857: Red Hat Enterprise Linux AppStream (v. 10)
ADP: RHSA-2026:30851: Red Hat Enterprise Linux AppStream (v. 8)
ADP: RHSA-2026:30856: Red Hat Enterprise Linux AppStream (v. 9)
ADP: RHSA-2026:30852: Red Hat Enterprise Linux BaseOS (v. 8)
Workarounds
ADP: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.