PT-2026-43163 · Cpan · Archive Tar

Stig Palmquist · Published 2026-05-26 · Updated 2026-06-25 · CVE-2026-42497

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Archive::Tar versions prior to 3.08

Description Archive::Tar for Perl allows the extraction of hardlinks to attacker-controlled paths outside the intended extraction directory. The function make special file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, which creates a hardlink sharing the victim file's inode. A subsequent write through the extracted name modifies the victim file. Additionally, the post-extraction chmod, chown, and utime block in extract file() applies the tar header's mode, owner, and timestamps to the shared inode during extraction, as it is only guarded against symlinks via -l.

Recommendations Update to version 3.08 or later.

Exploit

Fix

Link Following

Incorrect Permission

Weakness Enumeration

CWE-59

CWE-732

Related Identifiers

CVE-2026-42497

ECHO-CFD1-A043-7D5C

Affected Products

Archive Tar

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42497.json · Exploit
• https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-42497 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-13-CVE-2026-42497 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2026-42497 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-42497 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-42496 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-42497 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-42497 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-42497 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2026-42497 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-42497 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-42497 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-42497 · Security Note
• https://github.com/jib/archive-tar-new · Note