CVE-2026-42497
Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory
Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.
_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.
A subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.
_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.
A subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.
- Record
CVE-2026-42497- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-59, CWE-732
- Updated
- 2026-11-02
CVE List
Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory
Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.
_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.
A subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.
- Record
CVE-2026-42497- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-59, CWE-732
- Updated
- 2026-11-02
EUVDEUVD-2026-31777
Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.
_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.
A subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.
- Record
EUVD-2026-31777- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-fcfm-93gv-wh6f
Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside...
Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.
_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.
A subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.
- Record
GHSA-fcfm-93gv-wh6f- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-59
- Updated
- 2026-11-02
OSVALPINE-CVE-2026-42497
Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.
_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.
A subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.
- Record
ALPINE-CVE-2026-42497- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-03
OSVBELL-CVE-2026-42497
- Record
BELL-CVE-2026-42497- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Show 8 moreShow less
OSV
Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory
Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.
_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.
A subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.
- Record
CVE-2026-42497- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-59, CWE-732
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-42497
Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory. _make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode. A subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.
- Record
DEBIAN-CVE-2026-42497- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2026-42497
CVE-2026-42497 in perl - Patched by Root
Root has patched CVE-2026-42497 in the perl package for Root:Debian:11. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-11-CVE-2026-42497- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-42497
CVE-2026-42497 in perl - Patched by Root
Root has patched CVE-2026-42497 in the perl package for Root:Debian:12. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-12-CVE-2026-42497- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2026-42497
CVE-2026-42497 in perl - Patched by Root
Root has patched CVE-2026-42497 in the perl package for Root:Debian:13. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-13-CVE-2026-42497- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-42497
Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory. _make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode. A subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.
- Record
UBUNTU-CVE-2026-42497- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-06
OSVAZL-89136 No score
CVE-2026-42497 affecting package perl for versions less than 5.38.2-510
Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.
_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.
A subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.
- Record
AZL-89136- Updated
- 2026-11-05
OSVMGASA-2026-0230 No score
Updated perl-Archive-Tar package fixes security vulnerabilities
The updated package fixes security vulnerabilities: Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. (CVE-2026-42496) Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory. (CVE-2026-42497) Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header. (CVE-2026-9538)
- Record
MGASA-2026-0230- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
perlAlpine:v3.24 |
before 5.42.3-r0 | 5.42.3-r0 |
perlAzure Linux:3 |
before 5.38.2-510 | 5.38.2-510 |
perlAlpaquita:23 |
5.36.0-r0 up to 5.36.3-r2 | 5.36.3-r2 |
perlAlpaquita:25 |
5.40.2-r0 up to 5.40.4-r1 | 5.40.4-r1 |
perlAlpaquita:stream |
5.36.0-r0 up to 5.42.2-r1 | 5.42.2-r1 |
perlBellSoft Hardened Containers:23 |
5.36.0-r0 up to 5.36.3-r2 | 5.36.3-r2 |
perlBellSoft Hardened Containers:25 |
5.40.2-r0 up to 5.40.4-r1 | 5.40.4-r1 |
perlBellSoft Hardened Containers:stream |
5.36.0-r0 up to 5.42.2-r1 | 5.42.2-r1 |
perlDebian:12 |
before 5.36.0-7+deb12u4, plus listed versions 5.36.0-75.36.0-7+deb12u15.36.0-7+deb12u25.36.0-7+deb12u3 |
5.36.0-7+deb12u4 |
perlDebian:13 |
before 5.40.1-6+deb13u1, plus listed versions 5.40.1-6 |
5.40.1-6+deb13u1 |
Show 12 moreShow less
| Package | Affected | Fixed |
|---|---|---|
perlDebian:14 |
before 5.42.3-1, plus listed versions 5.40.1-65.40.1-75.40.1-85.42.0-15.42.0-2 Show 4 moreShow less5.42.0-35.42.2-15.42.2-25.42.2-3 |
5.42.3-1 |
perl-Archive-TarMageia:9 From an advisory covering 3 CVEs |
before 2.380.0-2.1.mga9 | 2.380.0-2.1.mga9 |
perlRoot:Debian:11 |
before 5.32.1-4+deb11u5.aikido.6 | 5.32.1-4+deb11u5.aikido.65.32.1-4+deb11u5.aikido.75.32.1-4+deb11u5.aikido.85.32.1-4+deb11u5.aikido.95.32.1-4+deb11u5.aikido.105.32.1-4+deb11u5.aikido.115.32.1-4+deb11u5.root.io.25.32.1-4+deb11u5.aikido.125.32.1-4+deb11u5.root.io.55.32.1-4+deb11u5.root.io.4 |
rootio-perlRoot:Debian:11 |
before 5.32.1-4+deb11u5.aikido.6 | 5.32.1-4+deb11u5.aikido.65.32.1-4+deb11u5.aikido.75.32.1-4+deb11u5.aikido.85.32.1-4+deb11u5.aikido.95.32.1-4+deb11u5.aikido.105.32.1-4+deb11u5.aikido.115.32.1-4+deb11u5.root.io.25.32.1-4+deb11u5.aikido.125.32.1-4+deb11u5.root.io.55.32.1-4+deb11u5.root.io.4 |
perlUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 5.14.2-21build15.18.1-45.18.1-4build15.18.1-55.18.2-2 Show 12 moreShow less5.18.2-2ubuntu15.18.2-2ubuntu1.15.18.2-2ubuntu1.35.18.2-2ubuntu1.45.18.2-2ubuntu1.65.18.2-2ubuntu1.75.18.2-2ubuntu1.7+esm35.18.2-2ubuntu1.7+esm45.18.2-2ubuntu1.7+esm55.18.2-2ubuntu1.7+esm75.18.2-2ubuntu1.7+esm85.18.2-2ubuntu1.7+esm9 |
None known |
perlUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 5.20.2-65.22.1-35.22.1-45.22.1-55.22.1-7 Show 11 moreShow less5.22.1-85.22.1-95.22.1-9ubuntu0.25.22.1-9ubuntu0.35.22.1-9ubuntu0.55.22.1-9ubuntu0.65.22.1-9ubuntu0.95.22.1-9ubuntu0.9+esm15.22.1-9ubuntu0.9+esm25.22.1-9ubuntu0.9+esm35.22.1-9ubuntu0.9+esm4 |
None known |
perlUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 5.26.0-8ubuntu15.26.1-2ubuntu15.26.1-35.26.1-45.26.1-4build1 Show 11 moreShow less5.26.1-55.26.1-65.26.1-6ubuntu0.15.26.1-6ubuntu0.25.26.1-6ubuntu0.35.26.1-6ubuntu0.55.26.1-6ubuntu0.65.26.1-6ubuntu0.75.26.1-6ubuntu0.7+esm25.26.1-6ubuntu0.7+esm35.26.1-6ubuntu0.7+esm4 |
None known |
perlUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 5.28.1-6build15.30.0-75.30.0-95.30.0-9build15.30.0-9ubuntu0.2 Show 6 moreShow less5.30.0-9ubuntu0.35.30.0-9ubuntu0.45.30.0-9ubuntu0.55.30.0-9ubuntu0.5+esm25.30.0-9ubuntu0.5+esm35.30.0-9ubuntu0.5+esm4 |
None known |
perlUbuntu:22.04:LTS |
All versions, plus listed versions 5.32.1-3ubuntu35.34.0-3ubuntu15.34.0-3ubuntu1.15.34.0-3ubuntu1.25.34.0-3ubuntu1.3 Show 5 moreShow less5.34.0-3ubuntu1.45.34.0-3ubuntu1.55.34.0-3ubuntu1.75.34.0-3ubuntu1.85.34.0-3ubuntu1.9 |
None known |
perlUbuntu:24.04:LTS |
before 5.38.2-3.2ubuntu0.3, plus listed versions 5.36.0-9ubuntu15.36.0-10ubuntu15.38.2-35.38.2-3.25.38.2-3.2build1 Show 4 moreShow less5.38.2-3.2build25.38.2-3.2build2.15.38.2-3.2ubuntu0.15.38.2-3.2ubuntu0.2 |
5.38.2-3.2ubuntu0.3 |
perlUbuntu:25.10 |
All versions, plus listed versions 5.40.1-25.40.1-35.40.1-55.40.1-65.40.1-6build15.40.1-6ubuntu0.1 |
None known |
perlUbuntu:26.10 |
All versions, plus listed versions 5.40.1-7build15.40.1-85.40.1-8ubuntu15.42.3-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| affected | OSV | |
| affected, aliases, facts, references | OSV | |
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-42497 is a high vulnerability (CVSS 7.5) in Bingos Archive::tar, published May 26, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 39th percentile. Fixed in perl 5.42.3-r0.
References
github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch
metacpan.org/release/BINGOS/Archive-Tar-3.08/changes
cve.org/CVERecord?id=CVE-2026-42496
nvd.nist.gov/vuln/detail/CVE-2026-42497
security.alpinelinux.org/vuln/CVE-2026-42497
Show 13 moreShow less
docs.bell-sw.com/security/cves/CVE-2026-42497
cpan.org/modules
security-tracker.debian.org/tracker/CVE-2026-42497
advisories.mageia.org/MGASA-2026-0230.html
bugs.mageia.org/show_bug.cgi?id=35587
openwall.com/lists/oss-security/2026/05/26/2
ubuntu.com/security/CVE-2026-42497
lists.security.metacpan.org/cve-announce/msg/40396457