Skip to content
CVE PROGRAM SOURCE RECORD9.1 Critical

CVE-2026-42496

Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
CPANSec

Description

Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target. A subsequent open through the extracted name reads or writes the attacker chosen path.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

BINGOS Archive::Tar

Default version status: unaffected

  • 0 to < 3.08affected

References