GnuPG gpgtar CVE-2026-105712

Requires all of the following: the victim must extract an UNTRUSTED archive using gpgtar's --directory (-C) option, the chosen target directory must ALREADY EXIST and be NON-EMPTY, and it must contain (or resolve through) a pre-existing symlink that gpgtar then follows to write outside the intended path. Extraction into a fresh empty directory is explicitly not affected. Exploitation is further limited by (1) mandatory user interaction - the victim must actively run the extraction, (2) the extraction user's own filesystem permissions bounding what can be overwritten, and (3) local access to deliver and have the archive processed. Affects GnuPG before 2.5.19.

This is a genuinely low-priority issue despite being a real, vendor-confirmed flaw. The CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L, base 3.6) tells a consistent story: exploitation is local, requires high attack complexity, depends on victim interaction (the user must actively extract the archive), and yields only limited integrity/availability impact with no confidentiality loss. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis - so no public exploit identified at time of analysis is the correct exploitation status. The description's constraints (file overwrite only via a pre-existing symlink in a non-empty target directory, bounded by the extraction user's filesystem permissions) corroborate the high-complexity, low-impact rating rather than contradicting it. Note the 'Information Disclosure' tag conflicts with the actual impact: CWE-61 (symlink following) and the C:N/I:L vector make this a file-overwrite (integrity) issue, not disclosure - treat the tag as inaccurate. Bottom line: a legitimately low-real-risk issue; patch in routine maintenance, not as an emergency.

An attacker distributes a crafted gpgtar archive and convinces a victim to extract it with gpgtar --directory/-C into an existing directory that already contains an attacker-anticipated or attacker-planted symlink. During extraction gpgtar follows that symlink, writing or overwriting a file outside the intended extraction directory, limited to what the extraction user's permissions allow. No public exploit identified at time of analysis, and the required user interaction plus pre-existing symlink make opportunistic exploitation unlikely.