Every CVE Search/ Get API key

CVE-2026-105712

gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When...

3.6 LowFix available

gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
Low

Exploit likelihood

0.13%Unchanged since Oct 6, 2026
90%50%10%1%

What each source reports

CVE List Score used 3.6

gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.

Record
CVE-2026-105712
CVSS 3.1
3.6 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
Weakness
CWE-61
Updated
2026-11-02
EUVDEUVD-2026-92634 3.6

gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.

Record
EUVD-2026-92634
CVSS 3.1
3.6 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-9w76-549g-prc8 3.6

gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When...

gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.

Record
GHSA-9w76-549g-prc8
CVSS 3.1
3.6 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
Weakness
CWE-61
Updated
2026-11-02
NVD 3.6

gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.

Record
CVE-2026-105712
CVSS 3.1
3.6 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
Weakness
CWE-61
Updated
2026-11-02
OSVBELL-CVE-2026-105712 3.6
Record
BELL-CVE-2026-105712
CVSS 3.1
3.6 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
Updated
2026-11-07
OSV 3.6

gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.

Record
CVE-2026-105712
CVSS 3.1
3.6 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
Weakness
CWE-61
Updated
2026-11-02
Show 9 moreShow less
OSVDEBIAN-CVE-2026-105712 3.6

gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.

Record
DEBIAN-CVE-2026-105712
CVSS 3.1
3.6 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVOESA-2026-4360 3.6

gnupg2 security update

GnuPG is a complete and free implementation of the OpenPGP standard as defined by RFC4880 (also known as PGP). GnuPG enables encryption and signing of data and communication, and features a versatile key management system as well as access modules for public key directories.

Security Fix(es):

gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.(CVE-2026-105712)

Record
OESA-2026-4360
CVSS 3.1
3.6 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVOESA-2026-4361 3.6

gnupg2 security update

GnuPG is a complete and free implementation of the OpenPGP standard as defined by RFC4880 (also known as PGP). GnuPG enables encryption and signing of data and communication, and features a versatile key management system as well as access modules for public key directories.

Security Fix(es):

gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.(CVE-2026-105712)

Record
OESA-2026-4361
CVSS 3.1
3.6 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVOESA-2026-4362 3.6

gnupg2 security update

GnuPG is a complete and free implementation of the OpenPGP standard as defined by RFC4880 (also known as PGP). GnuPG enables encryption and signing of data and communication, and features a versatile key management system as well as access modules for public key directories.

Security Fix(es):

gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.(CVE-2026-105712)

Record
OESA-2026-4362
CVSS 3.1
3.6 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVOESA-2026-4363 3.6

gnupg2 security update

GnuPG is a complete and free implementation of the OpenPGP standard as defined by RFC4880 (also known as PGP). GnuPG enables encryption and signing of data and communication, and features a versatile key management system as well as access modules for public key directories.

Security Fix(es):

gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.(CVE-2026-105712)

Record
OESA-2026-4363
CVSS 3.1
3.6 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVRHSA-2026:77484 3.6

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:77484
CVSS 3.1
3.6 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2026-105712 3.6

gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.

Record
UBUNTU-CVE-2026-105712
CVSS 3.1
3.6 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVAZL-105962 No score

CVE-2026-105712 affecting package gnupg2 2.4.9-3

gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.

Record
AZL-105962
Updated
2026-11-05
OSVCLSA-2026-1791488683 No score

Fix CVE(s): CVE-2026-105712

  • SECURITY UPDATE: file overwrite via symlink in gpgtar extraction
    • debian/patches/CVE-2026-105712.patch: refuse to extract with --directory into a non-empty directory or a symlink.
    • CVE-2026-105712
Record
CLSA-2026-1791488683
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
gnupg2
Azure Linux:3
 through 2.4.9-3 None known
gnupg
Alpaquita:23
 2.2.40-r0 up to 2.2.40-r3
2.2.40-r3
gnupg
Alpaquita:25
 2.4.7-r0 up to 2.4.9-r2
2.4.9-r2
gnupg
Alpaquita:stream
 2.4.0-r1 up to 2.5.22-r0
2.5.22-r0
dirmngr
TuxCare:Debian:10
 before 2.2.12-1+deb10u2+tuxcare.els3
2.2.12-1+deb10u2+tuxcare.els3
gnupg
TuxCare:Debian:10
 before 2.2.12-1+deb10u2+tuxcare.els3
2.2.12-1+deb10u2+tuxcare.els3
gnupg-agent
TuxCare:Debian:10
 before 2.2.12-1+deb10u2+tuxcare.els3
2.2.12-1+deb10u2+tuxcare.els3
gnupg-l10n
TuxCare:Debian:10
 before 2.2.12-1+deb10u2+tuxcare.els3
2.2.12-1+deb10u2+tuxcare.els3
gnupg-utils
TuxCare:Debian:10
 before 2.2.12-1+deb10u2+tuxcare.els3
2.2.12-1+deb10u2+tuxcare.els3
gnupg2
TuxCare:Debian:10
 before 2.2.12-1+deb10u2+tuxcare.els3
2.2.12-1+deb10u2+tuxcare.els3
Show 36 moreShow less
Affected packages
PackageAffectedFixed
gpg
TuxCare:Debian:10
 before 2.2.12-1+deb10u2+tuxcare.els3
2.2.12-1+deb10u2+tuxcare.els3
gpg-agent
TuxCare:Debian:10
 before 2.2.12-1+deb10u2+tuxcare.els3
2.2.12-1+deb10u2+tuxcare.els3
gpg-wks-client
TuxCare:Debian:10
 before 2.2.12-1+deb10u2+tuxcare.els3
2.2.12-1+deb10u2+tuxcare.els3
gpg-wks-server
TuxCare:Debian:10
 before 2.2.12-1+deb10u2+tuxcare.els3
2.2.12-1+deb10u2+tuxcare.els3
gpgconf
TuxCare:Debian:10
 before 2.2.12-1+deb10u2+tuxcare.els3
2.2.12-1+deb10u2+tuxcare.els3
gpgsm
TuxCare:Debian:10
 before 2.2.12-1+deb10u2+tuxcare.els3
2.2.12-1+deb10u2+tuxcare.els3
gpgv
TuxCare:Debian:10
 before 2.2.12-1+deb10u2+tuxcare.els3
2.2.12-1+deb10u2+tuxcare.els3
gpgv-static
TuxCare:Debian:10
 before 2.2.12-1+deb10u2+tuxcare.els3
2.2.12-1+deb10u2+tuxcare.els3
gpgv-win32
TuxCare:Debian:10
 before 2.2.12-1+deb10u2+tuxcare.els3
2.2.12-1+deb10u2+tuxcare.els3
gpgv2
TuxCare:Debian:10
 before 2.2.12-1+deb10u2+tuxcare.els3
2.2.12-1+deb10u2+tuxcare.els3
scdaemon
TuxCare:Debian:10
 before 2.2.12-1+deb10u2+tuxcare.els3
2.2.12-1+deb10u2+tuxcare.els3
gnupg2
Debian:12
 All versions, plus listed versions
2.2.40-1.12.2.40-1.1+deb12u12.2.40-1.1+deb12u22.2.40-1.1+hurd.12.2.40-1.1+loong64
Show 45 moreShow less
2.2.40-22.2.40-32.2.43-12.2.43-22.2.43-32.2.43-42.2.43-52.2.43-62.2.43-72.2.43-82.2.44-12.2.45-12.2.45-22.2.45-32.2.46-12.2.46-22.2.46-32.2.46-42.2.46-52.2.46-62.2.46~pre1-12.3.1-12.4.3-22.4.4-12.4.4-22.4.4-32.4.4-42.4.5-12.4.5-22.4.5-32.4.6-12.4.7-12.4.7-102.4.7-112.4.7-122.4.7-132.4.7-142.4.7-152.4.7-162.4.7-172.4.7-182.4.7-192.4.7-22.4.7-202.4.7-21
 None known
gnupg2
Debian:13
 All versions, plus listed versions
2.4.7-212.4.7-21+deb13u12.4.8-12.4.8-22.4.8-3
Show 11 moreShow less
2.4.8-42.4.8-52.4.8-62.4.9-12.4.9-22.4.9-32.4.9-42.4.9-52.4.9-62.4.9-72.4.9-8
 None known
gnupg2
Debian:14
 before 2.4.9-8, plus listed versions
2.4.7-212.4.8-12.4.8-22.4.8-32.4.8-4
Show 9 moreShow less
2.4.8-52.4.8-62.4.9-12.4.9-22.4.9-32.4.9-42.4.9-52.4.9-62.4.9-7
2.4.9-8
gnupg2
openEuler:22.03-LTS-SP4
 before 2.2.32-11.oe2203sp4
2.2.32-11.oe2203sp4
gnupg2
openEuler:24.03-LTS-SP1
 before 2.4.3-17.oe2403sp1
2.4.3-17.oe2403sp1
gnupg2
openEuler:24.03-LTS-SP3
 before 2.4.3-17.oe2403sp3
2.4.3-17.oe2403sp3
gnupg2
openEuler:24.03-LTS-SP4
 before 2.4.3-17.oe2403sp4
2.4.3-17.oe2403sp4
gnupg2
Red Hat:hummingbird:1
 before 0:2.4.9-18.1.hum1
0:2.4.9-18.1.hum1
gnupg2-dirmngr
Red Hat:hummingbird:1
 before 0:2.4.9-18.1.hum1
0:2.4.9-18.1.hum1
gnupg2-g13
Red Hat:hummingbird:1
 before 0:2.4.9-18.1.hum1
0:2.4.9-18.1.hum1
gnupg2-gpg-agent
Red Hat:hummingbird:1
 before 0:2.4.9-18.1.hum1
0:2.4.9-18.1.hum1
gnupg2-gpgconf
Red Hat:hummingbird:1
 before 0:2.4.9-18.1.hum1
0:2.4.9-18.1.hum1
gnupg2-keyboxd
Red Hat:hummingbird:1
 before 0:2.4.9-18.1.hum1
0:2.4.9-18.1.hum1
gnupg2-scdaemon
Red Hat:hummingbird:1
 before 0:2.4.9-18.1.hum1
0:2.4.9-18.1.hum1
gnupg2-smime
Red Hat:hummingbird:1
 before 0:2.4.9-18.1.hum1
0:2.4.9-18.1.hum1
gnupg2-utils
Red Hat:hummingbird:1
 before 0:2.4.9-18.1.hum1
0:2.4.9-18.1.hum1
gnupg2-verify
Red Hat:hummingbird:1
 before 0:2.4.9-18.1.hum1
0:2.4.9-18.1.hum1
gnupg2-wks
Red Hat:hummingbird:1
 before 0:2.4.9-18.1.hum1
0:2.4.9-18.1.hum1
gnupg2
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.0.28-3ubuntu12.0.28-3ubuntu22.1.11-6ubuntu12.1.11-6ubuntu22.1.11-6ubuntu2.12.1.11-6ubuntu2.1+esm12.1.11-6ubuntu2.1+esm22.1.11-6ubuntu2.1+esm3
 None known
gnupg2
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.1.15-1ubuntu82.2.4-1ubuntu12.2.4-1ubuntu1.12.2.4-1ubuntu1.22.2.4-1ubuntu1.3
Show 5 moreShow less
2.2.4-1ubuntu1.42.2.4-1ubuntu1.52.2.4-1ubuntu1.62.2.4-1ubuntu1.6+esm12.2.4-1ubuntu1.6+esm2
 None known
gnupg2
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2.2.12-1ubuntu32.2.17-3ubuntu12.2.19-3ubuntu22.2.19-3ubuntu2.12.2.19-3ubuntu2.22.2.19-3ubuntu2.42.2.19-3ubuntu2.52.2.19-3ubuntu2.5+esm1
 None known
gnupg2
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.2.20-1ubuntu42.2.27-2ubuntu12.2.27-3ubuntu12.2.27-3ubuntu22.2.27-3ubuntu2.12.2.27-3ubuntu2.32.2.27-3ubuntu2.42.2.27-3ubuntu2.5
 None known
gnupg2
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.2.40-1.1ubuntu12.4.4-2ubuntu72.4.4-2ubuntu152.4.4-2ubuntu162.4.4-2ubuntu17
Show 4 moreShow less
2.4.4-2ubuntu17.22.4.4-2ubuntu17.32.4.4-2ubuntu17.42.4.4-2ubuntu17.6
 None known
gnupg2
Ubuntu:26.10
 All versions, plus listed versions
2.4.8-4ubuntu32.4.9-4ubuntu12.4.9-4ubuntu22.4.9-4ubuntu3
 None known
gnupg2
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.4.8-2ubuntu22.4.8-4ubuntu12.4.8-4ubuntu22.4.8-4ubuntu32.4.8-4ubuntu3.1
 None known

History

History
RecordedChangedSources
affectedOSV
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-105712 is a low vulnerability (CVSS 3.6) in Gnupg, published October 5, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.13%, the 2nd percentile. Fixed in gnupg 2.2.40-r3.

References

Show 15 moreShow less
This page doesn't list everything

Left out here: 21 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open