Skip to main content

Red Hat Enterprise Linux 10 EUVDEUVD-2026-19317

| CVE-2026-5704 MEDIUM
Unrestricted Upload of File with Dangerous Type (CWE-434)
2026-04-06 redhat
File Upload Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat
5.5
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-434
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK

2 techniques across 2 tactics: Command and Control, Persistence

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Impact

This vulnerability presents a moderate real-world risk despite its CVSS score of 5.0. The attack vector is local (AV:L) and requires low privilege (PR:L) plus user interaction (UI:R), significantly limiting exposure compared to remote attacks. However, the integrity impact is high (I:H), meaning successful exploitation allows complete file injection. The CVSS vector indicates no confidentiality or availability impact. Critically, no EPSS score, KEV status, or public exploit code is provided, suggesting minimal evidence of active exploitation or automated weaponization. The real risk depends on operational context: if users routinely extract archives from untrusted sources, the threat is elevated; if extraction is tightly controlled or limited to trusted archives, the risk is substantially lower. This is a priority issue for organizations with loose archive handling practices, but not an emergency for environments with strong access controls and user training.
Exploit ScenarioDerived

A local user on a RHEL system receives a tar archive from a colleague or downloads it from a web server, believing it contains legitimate project files. The archive contains hidden files with malicious payloads crafted to exploit tar's path handling or file naming features. When the user extracts the archive (using tar -xf or a GUI archive manager), the hidden files are silently written to sensitive system directories or the user's home directory without triggering standard pre-extraction warnings or antivirus scans, because those tools only inspect the archive metadata, not the actual extraction behavior. The attacker's files then execute or are discovered by subsequent system processes, compromising the system's integrity.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 06, 2026

Tar archive extraction allows hidden file injection by local authenticated users through crafted malicious archives, bypassing pre-extraction inspection mechanisms and enabling introduction of attacker-controlled files. The vulnerability affects Red Hat Enterprise Linux versions 6 through 10, requires local access and user interaction (extraction action), and presents a moderate integrity risk (CVSS 5.0) with no confirmed active exploitation or public proof-of-concept at time of analysis.

RemediationAI

Apply the security update provided by Red Hat for your RHEL version through standard package management (yum or dnf). Check https://access.redhat.com/security/cve/CVE-2026-5704 for the specific patched tar package version corresponding to your RHEL release. Until patching is complete, implement procedural controls: restrict archive extraction to trusted sources only, require administrative review before extracting archives from external origins, and educate users to avoid extracting archives from untrusted parties. Consider using alternative archive extraction tools with stricter validation if available for your workflows, though the underlying issue may affect system tar more broadly.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability exists in the tar utility's handling of archive contents during extraction. It is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type), indicating a failure to properly validate or restrict file types and paths during archive extraction. The flaw allows an attacker to craft a specially formatted tar archive containing hidden files (likely leveraging tar's support for special file naming, path traversal sequences, or metadata manipulation) that evade conventional pre-extraction scanning tools. When a local user extracts such an archive with their privileges, the malicious files are written to unintended locations on the filesystem, bypassing detection mechanisms that examine the archive before extraction begins.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
SUSE MEDIUM
Red Hat 5.0 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

2
CVSS changed
Aug 31, 2026 - 21:22 NVD
5.0 (MEDIUM) 5.5 (MEDIUM)
CVE Published
Apr 06, 2026 - 15:17 nvd
MEDIUM 5.0

DescriptionNVD

A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.

Threat Intelligence Overview

EPSS Score
0.0%
Top 93% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact· derived
Medium
Technical Impact
Partial

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Malicious File Upload HIGH

Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.

Affected Products (CPE)NVD

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-434 – Unrestricted Upload of File with Dangerous Type

View all
CVE-2016-3088 CRITICAL POC
9.8
CVE-2021-31207 MEDIUM POC
6.6
CVE-2025-52691 CRITICAL POC
10.0
CVE-2017-12617 HIGH POC
8.1
CVE-2024-50623 CRITICAL POC
9.8
CVE-2017-11357 CRITICAL POC
9.8
CVE-2017-12615 HIGH POC
8.1
CVE-2018-9206 CRITICAL POC
9.8

Same technique File Upload

View all
CVE-2020-1938 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Fixed
SLES15-SP6-CHOST-BYOS Fixed
SLES15-SP6-CHOST-BYOS-Aliyun Fixed
SLES15-SP6-CHOST-BYOS-Azure Fixed
SLES15-SP6-CHOST-BYOS-EC2 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-5704 ADVISORY https://vuldb.com/vuln/355569 REF http://www.openwall.com/lists/oss-security/2026/04/11/10 REF http://www.openwall.com/lists/oss-security/2026/04/11/11 REF http://www.openwall.com/lists/oss-security/2026/04/12/2 REF https://access.redhat.com/errata/RHSA-2026:61581 REF https://access.redhat.com/errata/RHSA-2026:61586 REF https://access.redhat.com/errata/RHSA-2026:61783 REF https://access.redhat.com/errata/RHSA-2026:66018 REF https://access.redhat.com/errata/RHSA-2026:66514 REF https://access.redhat.com/errata/RHSA-2026:70390 REF https://access.redhat.com/security/cve/CVE-2026-5704 REF https://bugzilla.redhat.com/show_bug.cgi?id=2455360

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy