CVE-2026-42496

Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory

State: Published
Severity: 9.1 Critical
Published: May 26, 2026
Updated: Jul 15, 2026
Reserved: Apr 27, 2026

Read the record on cve.org

Description

Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.

_make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target.

A subsequent open through the extracted name reads or writes the attacker chosen path.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	CISA-ADP
3.1	8.2 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H	redhat-SADP

Weaknesses

CWE-59 Improper Link Resolution Before File Access ('Link Following')
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

Product	Versions
Archive::TarBINGOS	before 3.08Affected

References

https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patchpatch
https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changesrelease-notes
https://www.cve.org/CVERecord?id=CVE-2026-42497related
https://access.redhat.com/security/cve/CVE-2026-42496vdb-entry
RHBZ#2481314issue-tracking
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42496.json
https://access.redhat.com/errata/RHSA-2026:30857vendor-advisory
https://access.redhat.com/errata/RHSA-2026:30851vendor-advisory
https://access.redhat.com/errata/RHSA-2026:30856vendor-advisory
https://access.redhat.com/errata/RHSA-2026:30852vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.