EUVD-2026-31774
GHSA-8p37-q9qq-hgx8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft tar with malicious symlink target
-
DeliverySubmit archive to extraction service
-
ExploitArchive::Tar extracts without validating linkname
-
ExecutionLink resolves outside extraction directory
-
ImpactRead or overwrite arbitrary files
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Symlink resolution safety
|
| Exploitation Conditions | Exploitation requires that an application use Archive::Tar (before 3.08) to extract an attacker-supplied tar archive containing a symlink entry whose linkname is either an absolute path or includes a '..' parent-directory component pointing outside the extraction directory; on vulnerable versions this succeeds even under the default (secure, INSECURE_EXTRACT_MODE=0) extraction mode because target validation was absent. Limiting factors: the attacker must get the victim to extract a malicious archive (so impact is bounded to systems that process untrusted tar input), and the maximum effect depends on the privileges and target paths writable by the extracting process. The CVSS UI:N/AV:N rating assumes an automated extraction service; for tooling that only handles trusted archives the realistic exposure is much lower. |
| Impact | Signals conflict and should be weighed carefully. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, score 9.1) models unauthenticated, low-complexity, no-interaction exploitation with high confidentiality and integrity impact - appropriate for an automated service that extracts uploaded archives, but the practical precondition (a victim application must process an attacker-supplied tar) is closer to attacker-controlled-input than a directly reachable network service, and UI:N understates the need for the archive to be ingested. Counterbalancing the high CVSS, EPSS is only 0.02% (6th percentile), there is no CISA KEV listing, and no public exploit was identified at time of analysis, suggesting this is not currently subject to widespread automated exploitation. The realistic priority is moderate-to-high for systems that extract untrusted tar archives via Archive::Tar (CI/CD, file-upload backends, package handling) and lower for code that only handles trusted local archives. |
| Exploit ScenarioDerived | An attacker uploads a crafted tar archive to a service that automatically unpacks it with Archive::Tar; the archive contains a symlink entry whose target is an absolute path like /etc or uses '../../' to escape the extraction directory. When the application extracts the archive, subsequent writes follow the planted symlink to overwrite or expose files outside the intended directory, enabling integrity and confidentiality compromise. No public proof-of-concept was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 27, 2026
Symlink-based path traversal in the Perl module Archive::Tar before version 3.08 allows a malicious tar archive to write or point files outside the intended extraction directory. When an application extracts an attacker-supplied archive, symlink entries whose targets are absolute paths or contain '..' traversal sequences are followed without validation, letting an attacker place links that resolve to arbitrary filesystem locations. EPSS is very low (0.02%, 6th percentile) and there is no public exploit identified at time of analysis, but the issue is rated CVSS 9.1 because Archive::Tar is widely embedded in automated server-side processing of untrusted archives.
RemediationAI
Vendor-released patch: Archive::Tar 3.08 - upgrade the CPAN module to 3.08 or later, or apply your OS vendor's patched package (Debian tracks fixed releases). The upstream fix is commit 17c873492a05eddc0de18c1485e0b2cccd5a9158 (https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch), which enforces target validation in the default secure extract mode. If you cannot upgrade immediately, ensure $Archive::Tar::INSECURE_EXTRACT_MODE is not enabled (it must remain 0/unset), but note that on pre-3.08 versions secure mode alone does NOT block malicious symlink targets, so also extract untrusted archives only inside a sandboxed/throwaway directory on a restricted account, validate or strip symlink and hardlink entries before extraction, and avoid extracting attacker-supplied archives as a privileged user - the trade-off being added processing overhead and rejection of legitimately link-bearing archives. Track the companion hardlink issue CVE-2026-42497, fixed in the same 3.08 release (https://www.cve.org/CVERecord?id=CVE-2026-42497).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Archive::Tar is a pure-Perl library (CPAN distribution archive-tar-new, releases by BINGOS) for reading and writing tar archives, commonly used by build tooling, package managers, and web services that ingest uploaded archives. The root cause is CWE-59 (Improper Link Resolution Before File Access / Link Following): the _make_special_file routine created symlink (and, in the sibling CVE-2026-42497, hardlink) entries using the linkname stored in the archive without checking whether that target escaped the extraction root. The 3.08 fix (commit 17c8734) adds validation in non-INSECURE_EXTRACT_MODE that rejects link entries whose target is absolute (File::Spec->file_name_is_absolute) or contains a '..' component (File::Spec->splitdir), erroring out instead of extracting. Note the input 'Buffer Overflow' tag is erroneous for this record - that label belongs to the unrelated CVE-2026-8376 Perl regex bug listed in the same oss-security post; CVE-2026-42496 is a link-following flaw, consistent with CWE-59.
Know when Archive gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3Description PRE-NVD
Executive ViewAI
Archive::Tar, a critical component embedded in many organizations' automated file processing workflows, exposes companies to unauthorized file placement and potential system compromise through a path traversal vulnerability (CVE-2026-42496). Any business process handling archive files-including CI/CD pipelines, backup restoration systems, and user file uploads-represents an attack surface that could compromise data integrity and system security. Immediate patching to version 3.08 is essential to eliminate this exposure before the vulnerability becomes an active target.
Apply vendor patch. Interim mitigations if deployment is delayed: restrict archive processing to cryptographically verified or trusted sources only; implement content validation before extraction; execute tar extraction in sandboxed or containerized environments with minimal filesystem permissions; enable detailed logging and monitoring of file creation and modification events from archive processing to detect anomalous activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
An issue in Archive v3.3.7 allows attackers to execute a path traversal via extracting a crafted zip file. Rated high se
An issue in Archive v3.3.7 allows attackers to spoof zip filenames which can lead to inconsistent filename parsing. Rate
In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mecha
Arbitrary file modification in the Perl Archive::Tar module before version 3.08 allows a malicious tar archive to create
Memory exhaustion in the Perl Archive::Tar module before version 3.10 lets remote attackers cause a denial of service by
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Buffer Overflow
View allVendor StatusVendor
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | vulnerable | 5.32.1-4+deb11u3 | - |
| bullseye (security) | vulnerable | 5.32.1-4+deb11u5 | - |
| bookworm | vulnerable | 5.36.0-7+deb12u3 | - |
| bookworm (security) | vulnerable | 5.36.0-7+deb12u2 | - |
| trixie | vulnerable | 5.40.1-6 | - |
| forky, sid | vulnerable | 5.40.1-7 | - |
| (unstable) | fixed | (unfixed) | - |
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Exploit-DB