GNU tar EUVD-2026-52327

Exploitation requires all of the following to be true simultaneously: (1) the victim must invoke tar with the --one-top-level option - this vulnerability does not affect standard tar extractions without that flag; (2) the victim must extract an attacker-controlled archive, requiring user interaction (UI:R in CVSS); (3) a preexisting symbolic link must already exist somewhere under the current working directory at the time of extraction - this is an environmental prerequisite the attacker does not directly control; (4) the affected GNU tar version must be installed (RHEL 6 through 10 or Red Hat Hardened Images). Exploitation is limited to local attack vector (AV:L), meaning it occurs on the system performing the extraction - remote extraction pipelines that write to local paths are within scope. No network-based unauthenticated attack path is implied.

The Red Hat-assigned CVSS 3.1 score of 4.4 with vector AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N is broadly reasonable but the AC:L rating merits scrutiny: the attack requires a preexisting symbolic link under the working directory, which is a specific environmental prerequisite outside the attacker's direct control and would more accurately reflect AC:H. Impact is constrained - C:L and I:L with no availability impact - meaning exfiltration or file corruption is bounded. No KEV listing and no identified public exploit keep the operational priority low. EPSS data is absent from the provided intelligence. This is not a high-priority emergency patch for most organizations, but it is meaningful risk in pipeline or automation contexts where untrusted archives are extracted with --one-top-level and symlinks may exist under common working directories (e.g., /tmp or home directories). The 'Information Disclosure' tag from Red Hat aligns with the C:L CVSS impact.

An attacker distributes a crafted tar archive - via email, package repository injection, or a compromised upstream source - that contains hardlink entries pointing outside the intended extraction directory. When an administrator or automated script extracts this archive using tar --one-top-level on a RHEL system where a symbolic link already exists under the working directory (e.g., /tmp/work/lib -> /etc), the hardlink resolution chains through the symlink, potentially overwriting or reading a sensitive file outside the extraction scope in a single operation. No public exploit code is identified at time of analysis.