Every CVE Search/ Get API key

CVE-2026-5704

Tar: tar: hidden file injection via crafted archives

5.0 MediumFix available

A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

0.47%Up 0.4 points since Apr 7, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.0

Tar: tar: hidden file injection via crafted archives

A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.

Record
CVE-2026-5704
CVSS 3.1
5.0 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
Weakness
CWE-434
Updated
2026-11-05
EUVDEUVD-2026-19317 5.0

A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.

Record
EUVD-2026-19317
CVSS 3.1
5.0 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
Updated
2026-11-05
GitHub AdvisoriesGHSA-jqqw-37x4-9rwj 5.0

A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a...

A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.

Record
GHSA-jqqw-37x4-9rwj
CVSS 3.1
5.0 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
Weakness
CWE-434
Updated
2026-11-02
NVD 5.0

A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.

Record
CVE-2026-5704
CVSS 3.1
5.0 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Weakness
CWE-434
Updated
2026-11-06
OSVDEBIAN-CVE-2026-5704 5.5

A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.

Record
DEBIAN-CVE-2026-5704
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVOESA-2026-3223 5.0

tar security update

GNU Tar provides the ability to create tar archives, as well as various other kinds of manipulation. For example, you can use Tar on previously created archives to extract files, to store additional files, or to update or list files which were already stored.

Security Fix(es):

A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.(CVE-2026-5704)

Record
OESA-2026-3223
CVSS 3.1
5.0 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
Updated
2026-11-02
Show 27 moreShow less
OSVRHSA-2026:61581 5.0

Red Hat Security Advisory: tar security, bug fix, and enhancement update

Record
RHSA-2026:61581
CVSS 3.1
5.0 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:61586 5.0

Red Hat Security Advisory: tar security, bug fix, and enhancement update

Record
RHSA-2026:61586
CVSS 3.1
5.0 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:66514 5.0

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:66514
CVSS 3.1
5.0 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:70390 5.6

Red Hat Security Advisory: tar security, bug fix, and enhancement update

Record
RHSA-2026:70390
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVRLSA-2026:61581 5.0

Moderate: tar security, bug fix, and enhancement update

The GNU tar program can save multiple files in an archive and restore files from an archive.

Security Fix(es):

  • tar: tar: Hidden file injection via crafted archives (CVE-2026-5704)

  • tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape (CVE-2026-18477)

  • tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite (CVE-2026-18508)

Bug Fix(es) and Enhancement(s):

  • tar: --one-top-level with absolute path fails [rhel-9] (JIRA:Rocky Linux-144021)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:61581
CVSS 3.1
5.0 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:61586 5.0

Moderate: tar security, bug fix, and enhancement update

The GNU tar program can save multiple files in an archive and restore files from an archive.

Security Fix(es):

  • tar: tar: Hidden file injection via crafted archives (CVE-2026-5704)

  • tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape (CVE-2026-18477)

  • tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite (CVE-2026-18508)

Bug Fix(es) and Enhancement(s):

  • tar: --one-top-level with absolute path fails (JIRA:Rocky Linux-143906)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:61586
CVSS 3.1
5.0 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:70390 5.6

Moderate: tar security, bug fix, and enhancement update

The GNU tar program can save multiple files in an archive and restore files from an archive.

Security Fix(es):

  • tar: Tar path traversal (CVE-2025-45582)

  • tar: tar: Hidden file injection via crafted archives (CVE-2026-5704)

  • tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape (CVE-2026-18477)

  • tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite (CVE-2026-18508)

Bug Fix(es) and Enhancement(s):

  • tar: --one-top-level with absolute path fails [rhel-8.10.z] (JIRA:Rocky Linux-144019)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:70390
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-5704 5.5

CVE-2026-5704 in tar - Patched by Root

Root has patched CVE-2026-5704 in the tar package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2026-5704
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2026-5704 5.5

CVE-2026-5704 in tar - Patched by Root

Root has patched CVE-2026-5704 in the tar package for Root:Debian:13. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-13-CVE-2026-5704
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVROOT-OS-UBUNTU-2204-CVE-2026-5704 5.5

CVE-2026-5704 in rootio-tar - Patched by Root

Root has patched CVE-2026-5704 in the rootio-tar package for Root:Ubuntu:22.04. Multiple fixed versions available.

Record
ROOT-OS-UBUNTU-2204-CVE-2026-5704
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVROOT-OS-UBUNTU-2404-CVE-2026-5704 5.5

CVE-2026-5704 in rootio-tar - Patched by Root

Root has patched CVE-2026-5704 in the rootio-tar package for Root:Ubuntu:24.04. Multiple fixed versions available.

Record
ROOT-OS-UBUNTU-2404-CVE-2026-5704
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-5704 5.0

A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.

Record
UBUNTU-CVE-2026-5704
CVSS 3.1
5.0 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVALSA-2026:61581 No score

Moderate: tar security, bug fix, and enhancement update

The GNU tar program can save multiple files in an archive and restore files from an archive.

Security Fix(es):

  • tar: tar: Hidden file injection via crafted archives (CVE-2026-5704)
  • tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape (CVE-2026-18477)
  • tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite (CVE-2026-18508)

Bug Fix(es) and Enhancement(s):

  • tar: --one-top-level with absolute path fails [almalinux-9] (JIRA:AlmaLinux-144021)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:61581
Updated
2026-11-02
OSVALSA-2026:61586 No score

Moderate: tar security, bug fix, and enhancement update

The GNU tar program can save multiple files in an archive and restore files from an archive.

Security Fix(es):

  • tar: tar: Hidden file injection via crafted archives (CVE-2026-5704)
  • tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape (CVE-2026-18477)
  • tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite (CVE-2026-18508)

Bug Fix(es) and Enhancement(s):

  • tar: --one-top-level with absolute path fails (JIRA:AlmaLinux-143906)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:61586
Updated
2026-11-02
OSVALSA-2026:70390 No score

Moderate: tar security, bug fix, and enhancement update

The GNU tar program can save multiple files in an archive and restore files from an archive.

Security Fix(es):

  • tar: Tar path traversal (CVE-2025-45582)
  • tar: tar: Hidden file injection via crafted archives (CVE-2026-5704)
  • tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape (CVE-2026-18477)
  • tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite (CVE-2026-18508)

Bug Fix(es) and Enhancement(s):

  • tar: --one-top-level with absolute path fails [almalinux-8.10.z] (JIRA:AlmaLinux-144019)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:70390
Updated
2026-11-02
OSVAZL-98237 No score

CVE-2026-5704 affecting package tar 1.35-2

A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.

Record
AZL-98237
Updated
2026-11-02
OSVCLSA-2026-1791450288 No score

tar: Fix of CVE-2026-5704

  • CVE-2026-5704: make listing and extraction skip archive members the same way, so a crafted archive can no longer inject a file hidden from tar -t
Record
CLSA-2026-1791450288
Updated
2026-11-02
OSVCLSA-2026-1791452899 No score

tar: Fix of CVE-2026-5704

  • CVE-2026-5704: make listing and extraction skip archive members the same way, so a crafted archive can no longer inject a file hidden from tar -t
Record
CLSA-2026-1791452899
Updated
2026-11-02
OSVMGASA-2026-0168 No score

Updated tar packages fix security vulnerability

A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection. This update fixes the reported issue.

Record
MGASA-2026-0168
Updated
2026-11-02
OSVopenSUSE-SU-2026:11125-1 No score

tar-1.35-8.1 on GA media

These are all security issues fixed in the tar-1.35-8.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11125-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21070-1 No score

Security update for tar

This update for tar fixes the following issues

  • CVE-2026-5704: crafted archives can be used to to hide file injection (bsc#1261900).
  • Fix --dereference/-h not working properly after CVE-2025-45582 fix (bsc#1265450).
Record
openSUSE-SU-2026:21070-1
Updated
2026-11-02
OSVSUSE-SU-2026:22289-1 No score

Security update for tar

This update for tar fixes the following issues

  • CVE-2026-5704: crafted archives can be used to to hide file injection (bsc#1261900).
  • Fix --dereference/-h not working properly after CVE-2025-45582 fix (bsc#1265450).
Record
SUSE-SU-2026:22289-1
Updated
2026-11-02
OSVSUSE-SU-2026:22377-1 No score

Security update for tar

This update for tar fixes the following issues

  • CVE-2026-5704: crafted archives can be used to to hide file injection (bsc#1261900).
  • Fix --dereference/-h not working properly after CVE-2025-45582 fix (bsc#1265450).
Record
SUSE-SU-2026:22377-1
Updated
2026-11-02
OSVSUSE-SU-2026:2714-1 No score

Security update for tar

This update for tar fixes the following issues

Security fixes:

  • CVE-2026-5704: crafted archives can be used to to hide file injection (bsc#1261900).

Other fixes:

  • Fix tar changing dir permissions temporarily even when using --no-overwrite-dir.
  • Fix --dereference/-h not working properly after CVE-2025-45582 fix (bsc#1265450).
  • Fix extraction failure for paths like 'a/./b' caused by the gnulib openat2 implementation (bsc#1267189).
Record
SUSE-SU-2026:2714-1
Updated
2026-11-02
OSVUSN-8477-1 No score

tar vulnerability

It was discovered that tar incorrectly handled certain crafted archive files. An attacker could possibly use this to inject hidden files with attacker-controlled content, bypassing pre-extraction inspection mechanisms.

Record
USN-8477-1
Updated
2026-11-02
OSVUSN-8477-2 No score

tar regression

USN-8477-1 fixed a vulnerability in tar. The update introduced a regression that could cause tar to fail to extract certain valid files. This update fixes the problem.

Original advisory details:

It was discovered that tar incorrectly handled certain crafted archive files. An attacker could possibly use this to inject hidden files with attacker-controlled content, bypassing pre-extraction inspection mechanisms.

Record
USN-8477-2
Updated
2026-11-02
OSVUSN-8477-3 No score

tar regression

USN-8477-1 fixed a vulnerability in tar. That fix was incomplete and could cause tar to fail to extract old archives that recorded a nonzero size for directory entries, resulting in a regression. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

It was discovered that tar incorrectly handled certain crafted archive files. An attacker could possibly use this to inject hidden files with attacker-controlled content, bypassing pre-extraction inspection mechanisms.

Record
USN-8477-3
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
tar
AlmaLinux:9
From an advisory covering 3 CVEs
 before 2:1.34-13.el9_8
2:1.34-13.el9_8
tar
AlmaLinux:10
From an advisory covering 3 CVEs
 before 2:1.35-13.el10_2
2:1.35-13.el10_2
tar
AlmaLinux:8
From an advisory covering 4 CVEs
 before 2:1.30-13.el8_10
2:1.30-13.el8_10
tar
Azure Linux:3
 through 1.35-2 None known
tar
TuxCare:AlmaLinux:9.6
 before 2:1.34-7.el9.tuxcare.els6
2:1.34-7.el9.tuxcare.els6
tar
TuxCare:AlmaLinux:9.2
 before 2:1.34-7.el9.tuxcare.els6
2:1.34-7.el9.tuxcare.els6
tar
Debian:12
 All versions, plus listed versions
1.34+dfsg-1.21.34+dfsg-1.2+deb12u11.34+dfsg-1.31.34+dfsg-1.41.35+dfsg-1
Show 8 moreShow less
1.35+dfsg-21.35+dfsg-31.35+dfsg-3.11.35+dfsg-41.35+dfsg-51.35+dfsg-5+hurd.11.35+dfsg-61.35+dfsg-7
 None known
tar
Debian:13
 All versions, plus listed versions
1.35+dfsg-3.11.35+dfsg-41.35+dfsg-51.35+dfsg-5+hurd.11.35+dfsg-61.35+dfsg-7
 None known
tar
Debian:14
 All versions, plus listed versions
1.35+dfsg-3.11.35+dfsg-41.35+dfsg-51.35+dfsg-5+hurd.11.35+dfsg-61.35+dfsg-7
 None known
tar
Mageia:9
 before 1.35-4.mga9
1.35-4.mga9
Show 63 moreShow less
Affected packages
PackageAffectedFixed
tar
openEuler:24.03-LTS-SP1
 before 1.35-6.oe2403sp1
1.35-6.oe2403sp1
tar
openEuler:24.03-LTS-SP3
 before 1.35-6.oe2403sp3
1.35-6.oe2403sp3
tar
openEuler:24.03-LTS-SP4
 before 1.35-6.oe2403sp4
1.35-6.oe2403sp4
tar
openEuler:20.03-LTS-SP4
 before 1.32-6.oe2003sp4
1.32-6.oe2003sp4
tar
openEuler:22.03-LTS-SP4
 before 1.34-8.oe2203sp4
1.34-8.oe2203sp4
tar
Red Hat:enterprise_linux:9::baseos
From an advisory covering 3 CVEs
 before 2:1.34-13.el9_8
2:1.34-13.el9_8
tar-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 3 CVEs
 before 2:1.34-13.el9_8
2:1.34-13.el9_8
tar-debugsource
Red Hat:enterprise_linux:9::baseos
From an advisory covering 3 CVEs
 before 2:1.34-13.el9_8
2:1.34-13.el9_8
tar
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 2:1.35-13.el10_2
2:1.35-13.el10_2
tar-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 2:1.35-13.el10_2
2:1.35-13.el10_2
tar-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 2:1.35-13.el10_2
2:1.35-13.el10_2
tar
Red Hat:hummingbird:1
 before 0:1.35-10.hum1
0:1.35-10.hum1
tar
Red Hat:enterprise_linux:8::baseos
From an advisory covering 4 CVEs
 before 2:1.30-13.el8_10
2:1.30-13.el8_10
tar-debuginfo
Red Hat:enterprise_linux:8::baseos
From an advisory covering 4 CVEs
 before 2:1.30-13.el8_10
2:1.30-13.el8_10
tar-debugsource
Red Hat:enterprise_linux:8::baseos
From an advisory covering 4 CVEs
 before 2:1.30-13.el8_10
2:1.30-13.el8_10
tar
Rocky Linux:9
From an advisory covering 3 CVEs
 before 2:1.34-13.el9_8
2:1.34-13.el9_8
tar
Rocky Linux:10
From an advisory covering 3 CVEs
 before 2:1.35-13.el10_2
2:1.35-13.el10_2
tar
Rocky Linux:8
From an advisory covering 4 CVEs
 before 2:1.30-13.el8_10
2:1.30-13.el8_10
tar
Root:Debian:12
 before 1.34+dfsg-1.2+deb12u1.aikido.2
1.34+dfsg-1.2+deb12u1.aikido.21.34+dfsg-1.2+deb12u1.root.io.1
rootio-tar
Root:Debian:12
 before 1.34+dfsg-1.2+deb12u1.aikido.2
1.34+dfsg-1.2+deb12u1.aikido.21.34+dfsg-1.2+deb12u1.root.io.1
tar
Root:Debian:13
 before 1.35+dfsg-3.1.aikido.3
1.35+dfsg-3.1.aikido.31.35+dfsg-3.1.root.io.2
rootio-tar
Root:Debian:13
 before 1.35+dfsg-3.1.aikido.3
1.35+dfsg-3.1.aikido.31.35+dfsg-3.1.root.io.2
tar
SUSE:Linux Micro 6.2
From an advisory covering 2 CVEs
 before 1.35-160000.4.1
1.35-160000.4.1
tar
SUSE:Linux Enterprise Server 16.0
From an advisory covering 2 CVEs
 before 1.35-160000.4.1
1.35-160000.4.1
tar
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 2 CVEs
 before 1.35-160000.4.1
1.35-160000.4.1
tar
SUSE:Linux Enterprise Micro 5.3
 before 1.34-150000.3.42.1
1.34-150000.3.42.1
tar
SUSE:Linux Enterprise Micro 5.4
 before 1.34-150000.3.42.1
1.34-150000.3.42.1
tar
SUSE:Linux Enterprise Micro 5.5
 before 1.34-150000.3.42.1
1.34-150000.3.42.1
tar
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 1.34-150000.3.42.1
1.34-150000.3.42.1
tar
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 1.34-150000.3.42.1
1.34-150000.3.42.1
tar
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 1.34-150000.3.42.1
1.34-150000.3.42.1
tar
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
 before 1.34-150000.3.42.1
1.34-150000.3.42.1
tar
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
 before 1.34-150000.3.42.1
1.34-150000.3.42.1
tar
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 1.34-150000.3.42.1
1.34-150000.3.42.1
tar
SUSE:Linux Enterprise Server 15 SP5-LTSS
 before 1.34-150000.3.42.1
1.34-150000.3.42.1
tar
SUSE:Linux Enterprise Server 15 SP6-LTSS
 before 1.34-150000.3.42.1
1.34-150000.3.42.1
tar
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 1.34-150000.3.42.1
1.34-150000.3.42.1
tar
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
 before 1.34-150000.3.42.1
1.34-150000.3.42.1
tar
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
 before 1.34-150000.3.42.1
1.34-150000.3.42.1
tar
Ubuntu:Pro:14.04:LTS
 before 1.27.1-1ubuntu0.1+esm7, plus listed versions
1.26+dfsg-81.27-31.27-41.27.1-11.27.1-1ubuntu0.1
Show 6 moreShow less
1.27.1-1ubuntu0.1+esm11.27.1-1ubuntu0.1+esm21.27.1-1ubuntu0.1+esm31.27.1-1ubuntu0.1+esm41.27.1-1ubuntu0.1+esm51.27.1-1ubuntu0.1+esm6
1.27.1-1ubuntu0.1+esm7
tar
Ubuntu:Pro:16.04:LTS
 before 1.28-2.1ubuntu0.2+esm6, plus listed versions
1.27.1-21.28-2ubuntu11.28-2.11.28-2.1ubuntu0.11.28-2.1ubuntu0.2
Show 5 moreShow less
1.28-2.1ubuntu0.2+esm11.28-2.1ubuntu0.2+esm21.28-2.1ubuntu0.2+esm31.28-2.1ubuntu0.2+esm41.28-2.1ubuntu0.2+esm5
1.28-2.1ubuntu0.2+esm6
tar
Ubuntu:Pro:18.04:LTS
 before 1.29b-2ubuntu0.4+esm4, plus listed versions
1.29b-21.29b-2ubuntu0.11.29b-2ubuntu0.21.29b-2ubuntu0.31.29b-2ubuntu0.41.29b-2ubuntu0.4+esm11.29b-2ubuntu0.4+esm21.29b-2ubuntu0.4+esm3
1.29b-2ubuntu0.4+esm4
tar
Ubuntu:Pro:20.04:LTS
 before 1.30+dfsg-7ubuntu0.20.04.4+esm3, plus listed versions
1.30+dfsg-61.30+dfsg-71.30+dfsg-7ubuntu0.20.04.11.30+dfsg-7ubuntu0.20.04.21.30+dfsg-7ubuntu0.20.04.31.30+dfsg-7ubuntu0.20.04.41.30+dfsg-7ubuntu0.20.04.4+esm11.30+dfsg-7ubuntu0.20.04.4+esm2
1.30+dfsg-7ubuntu0.20.04.4+esm3
tar
Ubuntu:22.04:LTS
 before 1.34+dfsg-1ubuntu0.1.22.04.6, plus listed versions
1.34+dfsg-1build11.34+dfsg-1build21.34+dfsg-1build31.34+dfsg-1ubuntu0.1.22.04.11.34+dfsg-1ubuntu0.1.22.04.21.34+dfsg-1ubuntu0.1.22.04.31.34+dfsg-1ubuntu0.1.22.04.41.34+dfsg-1ubuntu0.1.22.04.5
1.34+dfsg-1ubuntu0.1.22.04.6
tar
Ubuntu:24.04:LTS
 before 1.35+dfsg-3ubuntu0.4, plus listed versions
1.34+dfsg-1.2ubuntu11.34+dfsg-1.2ubuntu21.34+dfsg-1.3ubuntu11.34+dfsg-1.41.35+dfsg-2~build1
Show 6 moreShow less
1.35+dfsg-21.35+dfsg-31.35+dfsg-3build11.35+dfsg-3ubuntu0.11.35+dfsg-3ubuntu0.21.35+dfsg-3ubuntu0.3
1.35+dfsg-3ubuntu0.4
tar
Ubuntu:25.10
 All versions, plus listed versions
1.35+dfsg-3.11.35+dfsg-3.1build1
 None known
tar
Ubuntu:26.04:LTS
 before 1.35+dfsg-4ubuntu0.4, plus listed versions
1.35+dfsg-3.1build11.35+dfsg-3.1build21.35+dfsg-41.35+dfsg-4ubuntu0.11.35+dfsg-4ubuntu0.21.35+dfsg-4ubuntu0.3
1.35+dfsg-4ubuntu0.4
tar
Ubuntu:Pro:14.04:LTS
 before 1.27.1-1ubuntu0.1+esm5, plus listed versions
1.26+dfsg-81.27-31.27-41.27.1-11.27.1-1ubuntu0.1
Show 4 moreShow less
1.27.1-1ubuntu0.1+esm11.27.1-1ubuntu0.1+esm21.27.1-1ubuntu0.1+esm31.27.1-1ubuntu0.1+esm4
1.27.1-1ubuntu0.1+esm5
tar
Ubuntu:Pro:16.04:LTS
 before 1.28-2.1ubuntu0.2+esm4, plus listed versions
1.27.1-21.28-2ubuntu11.28-2.11.28-2.1ubuntu0.11.28-2.1ubuntu0.21.28-2.1ubuntu0.2+esm11.28-2.1ubuntu0.2+esm21.28-2.1ubuntu0.2+esm3
1.28-2.1ubuntu0.2+esm4
tar
Ubuntu:Pro:18.04:LTS
 before 1.29b-2ubuntu0.4+esm2, plus listed versions
1.29b-21.29b-2ubuntu0.11.29b-2ubuntu0.21.29b-2ubuntu0.31.29b-2ubuntu0.41.29b-2ubuntu0.4+esm1
1.29b-2ubuntu0.4+esm2
tar
Ubuntu:Pro:20.04:LTS
 before 1.30+dfsg-7ubuntu0.20.04.4+esm1, plus listed versions
1.30+dfsg-61.30+dfsg-71.30+dfsg-7ubuntu0.20.04.11.30+dfsg-7ubuntu0.20.04.21.30+dfsg-7ubuntu0.20.04.31.30+dfsg-7ubuntu0.20.04.4
1.30+dfsg-7ubuntu0.20.04.4+esm1
tar
Ubuntu:22.04:LTS
 before 1.34+dfsg-1ubuntu0.1.22.04.3, plus listed versions
1.34+dfsg-1build11.34+dfsg-1build21.34+dfsg-1build31.34+dfsg-1ubuntu0.1.22.04.11.34+dfsg-1ubuntu0.1.22.04.2
1.34+dfsg-1ubuntu0.1.22.04.3
tar
Ubuntu:24.04:LTS
 before 1.35+dfsg-3ubuntu0.1, plus listed versions
1.34+dfsg-1.2ubuntu11.34+dfsg-1.2ubuntu21.34+dfsg-1.3ubuntu11.34+dfsg-1.41.35+dfsg-2~build11.35+dfsg-21.35+dfsg-31.35+dfsg-3build1
1.35+dfsg-3ubuntu0.1
tar
Ubuntu:26.04:LTS
 before 1.35+dfsg-4ubuntu0.1, plus listed versions
1.35+dfsg-3.1build11.35+dfsg-3.1build21.35+dfsg-4
1.35+dfsg-4ubuntu0.1
tar
Ubuntu:Pro:14.04:LTS
 before 1.27.1-1ubuntu0.1+esm6, plus listed versions
1.26+dfsg-81.27-31.27-41.27.1-11.27.1-1ubuntu0.1
Show 5 moreShow less
1.27.1-1ubuntu0.1+esm11.27.1-1ubuntu0.1+esm21.27.1-1ubuntu0.1+esm31.27.1-1ubuntu0.1+esm41.27.1-1ubuntu0.1+esm5
1.27.1-1ubuntu0.1+esm6
tar
Ubuntu:Pro:16.04:LTS
 before 1.28-2.1ubuntu0.2+esm5, plus listed versions
1.27.1-21.28-2ubuntu11.28-2.11.28-2.1ubuntu0.11.28-2.1ubuntu0.2
Show 4 moreShow less
1.28-2.1ubuntu0.2+esm11.28-2.1ubuntu0.2+esm21.28-2.1ubuntu0.2+esm31.28-2.1ubuntu0.2+esm4
1.28-2.1ubuntu0.2+esm5
tar
Ubuntu:Pro:18.04:LTS
 before 1.29b-2ubuntu0.4+esm3, plus listed versions
1.29b-21.29b-2ubuntu0.11.29b-2ubuntu0.21.29b-2ubuntu0.31.29b-2ubuntu0.41.29b-2ubuntu0.4+esm11.29b-2ubuntu0.4+esm2
1.29b-2ubuntu0.4+esm3
tar
Ubuntu:Pro:20.04:LTS
 before 1.30+dfsg-7ubuntu0.20.04.4+esm2, plus listed versions
1.30+dfsg-61.30+dfsg-71.30+dfsg-7ubuntu0.20.04.11.30+dfsg-7ubuntu0.20.04.21.30+dfsg-7ubuntu0.20.04.31.30+dfsg-7ubuntu0.20.04.41.30+dfsg-7ubuntu0.20.04.4+esm1
1.30+dfsg-7ubuntu0.20.04.4+esm2
tar
Ubuntu:22.04:LTS
 before 1.34+dfsg-1ubuntu0.1.22.04.5, plus listed versions
1.34+dfsg-1build11.34+dfsg-1build21.34+dfsg-1build31.34+dfsg-1ubuntu0.1.22.04.11.34+dfsg-1ubuntu0.1.22.04.21.34+dfsg-1ubuntu0.1.22.04.31.34+dfsg-1ubuntu0.1.22.04.4
1.34+dfsg-1ubuntu0.1.22.04.5
tar
Ubuntu:24.04:LTS
 before 1.35+dfsg-3ubuntu0.3, plus listed versions
1.34+dfsg-1.2ubuntu11.34+dfsg-1.2ubuntu21.34+dfsg-1.3ubuntu11.34+dfsg-1.41.35+dfsg-2~build1
Show 5 moreShow less
1.35+dfsg-21.35+dfsg-31.35+dfsg-3build11.35+dfsg-3ubuntu0.11.35+dfsg-3ubuntu0.2
1.35+dfsg-3ubuntu0.3
tar
Ubuntu:26.04:LTS
 before 1.35+dfsg-4ubuntu0.3, plus listed versions
1.35+dfsg-3.1build11.35+dfsg-3.1build21.35+dfsg-41.35+dfsg-4ubuntu0.11.35+dfsg-4ubuntu0.2
1.35+dfsg-4ubuntu0.3
tar
openSUSE:Tumbleweed
 before 1.35-8.1
1.35-8.1
tar
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
 before 1.35-160000.4.1
1.35-160000.4.1

History

History
RecordedChangedSources
affectedCVE List, NVD
factsEUVD
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-5704 is a medium vulnerability (CVSS 5.0) in Gnu Tar, published April 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 41st percentile. Fixed in tar 2:1.34-7.el9.tuxcare.els6.

References

Show 61 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open