Archive::Tar CVE-2026-42497

Exploitation requires that a victim application or service extract an attacker-supplied tar archive using a vulnerable Archive::Tar version (anything before 3.08). No non-default configuration is needed - the weakness existed even in the default secure extraction path because hardlink targets were not validated before 3.08; setting $Archive::Tar::INSECURE_EXTRACT_MODE would only widen exposure. The concrete prerequisite in the archive is a hardlink (or symlink, the CVE-2026-42496 sibling) entry whose linkname is an absolute path or contains '..' traversal components. Limiting factors: the attacker must get their archive to a target that auto-extracts it; impact is integrity-only (file permission/content modification via the shared inode), with no confidentiality or availability impact per the CVSS vector; and hardlink semantics make this primarily relevant on Unix-like filesystems rather than Windows/msys (where the upstream symlink tests are skipped).

Signals conflict in informative ways. The CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) - unauthenticated, low-complexity, integrity-only impact - but EPSS is only 0.02% (5th percentile), there is no KEV listing, and no public exploit was identified, which points to a real but not widely-exploited weakness rather than an urgent mass-exploitation threat. The AV:N rating reflects that tar archives are commonly received over the network and extracted automatically; actual exploitation still requires that a victim application extract an attacker-controlled archive, so practical risk is concentrated in services that auto-process untrusted tarballs. A notable data-quality conflict must be flagged: the input Tags field says 'Buffer Overflow' and the Description fragment mentions a 'heap buffer overflow when compiling regular expressions' - that text is contamination from other CVEs bundled in the same oss-security digest (and CVE-2026-9538, a memory-exhaustion issue). CVE-2026-42497 is a link-following/path-traversal issue (CWE-59), not a buffer overflow; treat the buffer-overflow tag as erroneous. No SSVC decision data was provided.

An attacker crafts a tar archive containing a hardlink entry whose target is an absolute path (e.g. /etc/...) or uses ../ traversal to point outside the extraction directory, then delivers it to a service that extracts uploads with Archive::Tar < 3.08. When the victim extracts the archive, the library creates the hardlink and the chmod performed during extraction alters the permissions of the targeted external file. No public proof-of-concept exploit was identified at time of analysis.