PT-2026-43163 · Bingos · Archive Tar
Published
2026-05-26
·
Updated
2026-05-26
·
CVE-2026-42497
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.
make special file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.
A subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in extract file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.
Link Following
Incorrect Permission
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Archive Tar