Riskcovery

CVE-2026-5704

Tar: tar: hidden file injection via crafted archives

State
Published
Severity
5.0 Medium
Published
Apr 6, 2026
Updated
Sep 22, 2026
Reserved
Apr 6, 2026

Read the record on cve.org

Description

A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.

Scores

CVSSScoreVectorSource
3.15.0 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:Nredhat

Weaknesses

  • CWE-434 Unrestricted Upload of File with Dangerous Type

Affected Products

ProductVersions
Red Hat Enterprise Linux 10Red Hat
  • 2:1.35-13.el10_2 and laterNot affected
Red Hat Enterprise Linux 8Red Hat
  • 2:1.30-13.el8_10 and laterNot affected
Red Hat Enterprise Linux 9Red Hat
  • 2:1.34-13.el9_8 and laterNot affected
Red Hat Discovery 2Red Hat
  • 1788205779 and laterNot affected
Red Hat Hardened ImagesRed Hat
  • 1.35-10.hum1 and laterNot affected
Red Hat Update Infrastructure 5Red Hat
  • 1788880445 and laterNot affected
Red Hat Update Infrastructure 5Red Hat
  • 1788880464 and laterNot affected
Red Hat Update Infrastructure 5Red Hat
  • 1788880456 and laterNot affected
Red Hat Update Infrastructure 5Red Hat
  • 1788765051 and laterNot affected
Red Hat Update Infrastructure 5Red Hat
  • 1788880581 and laterNot affected
Red Hat Enterprise Linux 6Red Hat
    Red Hat Enterprise Linux 7Red Hat

      References

      Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.