{"id":"CVE-2026-105712","aliases":["AZL-105962","BELL-CVE-2026-105712","CLSA-2026-1791488683","DEBIAN-CVE-2026-105712","EUVD-2026-92634","GHSA-9w76-549g-prc8","OESA-2026-4360","OESA-2026-4361","OESA-2026-4362","OESA-2026-4363","RHSA-2026:77484","UBUNTU-CVE-2026-105712"],"status":"published","title":"gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When...","description":"gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.","severity":{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00128,"percentile":0.02518,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-61"],"published":"2026-10-05T18:53:09Z","modified":"2026-11-07T07:15:04Z","fixes":[{"ecosystem":"Alpaquita:23","package":"gnupg","fixed_in":["2.2.40-r3"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"gnupg","fixed_in":["2.4.9-r2"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"gnupg","fixed_in":["2.5.22-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"dirmngr","fixed_in":["2.2.12-1+deb10u2+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"gnupg","fixed_in":["2.2.12-1+deb10u2+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"gnupg-agent","fixed_in":["2.2.12-1+deb10u2+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"gnupg-l10n","fixed_in":["2.2.12-1+deb10u2+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"gnupg-utils","fixed_in":["2.2.12-1+deb10u2+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"gnupg2","fixed_in":["2.2.12-1+deb10u2+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"gpg","fixed_in":["2.2.12-1+deb10u2+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"gpg-agent","fixed_in":["2.2.12-1+deb10u2+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"gpg-wks-client","fixed_in":["2.2.12-1+deb10u2+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"gpg-wks-server","fixed_in":["2.2.12-1+deb10u2+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"gpgconf","fixed_in":["2.2.12-1+deb10u2+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"gpgsm","fixed_in":["2.2.12-1+deb10u2+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"gpgv","fixed_in":["2.2.12-1+deb10u2+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"gpgv-static","fixed_in":["2.2.12-1+deb10u2+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"gpgv-win32","fixed_in":["2.2.12-1+deb10u2+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"gpgv2","fixed_in":["2.2.12-1+deb10u2+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"scdaemon","fixed_in":["2.2.12-1+deb10u2+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gnupg2","fixed_in":["2.4.9-8"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"gnupg2","fixed_in":["2.2.32-11.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"gnupg2","fixed_in":["2.4.3-17.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"gnupg2","fixed_in":["2.4.3-17.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"gnupg2","fixed_in":["2.4.3-17.oe2403sp4"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"gnupg2","fixed_in":["0:2.4.9-18.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-dirmngr","fixed_in":["0:2.4.9-18.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-g13","fixed_in":["0:2.4.9-18.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-gpg-agent","fixed_in":["0:2.4.9-18.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-gpgconf","fixed_in":["0:2.4.9-18.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-keyboxd","fixed_in":["0:2.4.9-18.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-scdaemon","fixed_in":["0:2.4.9-18.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-smime","fixed_in":["0:2.4.9-18.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-utils","fixed_in":["0:2.4.9-18.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-verify","fixed_in":["0:2.4.9-18.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-wks","fixed_in":["0:2.4.9-18.1.hum1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.4.9-3"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.40-r0"},{"fixed":"2.2.40-r3"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.7-r0"},{"fixed":"2.4.9-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0-r1"},{"fixed":"2.5.22-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"dirmngr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"gnupg-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"gnupg-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"gnupg-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"gpg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"gpg-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"gpg-wks-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"gpg-wks-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"gpgconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"gpgsm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"gpgv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"gpgv-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"gpgv-win32","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"gpgv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"scdaemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-1+deb10u2+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.40-1.1","2.2.40-1.1+deb12u1","2.2.40-1.1+deb12u2","2.2.40-1.1+hurd.1","2.2.40-1.1+loong64","2.2.40-2","2.2.40-3","2.2.43-1","2.2.43-2","2.2.43-3","2.2.43-4","2.2.43-5","2.2.43-6","2.2.43-7","2.2.43-8","2.2.44-1","2.2.45-1","2.2.45-2","2.2.45-3","2.2.46-1","2.2.46-2","2.2.46-3","2.2.46-4","2.2.46-5","2.2.46-6","2.2.46~pre1-1","2.3.1-1","2.4.3-2","2.4.4-1","2.4.4-2","2.4.4-3","2.4.4-4","2.4.5-1","2.4.5-2","2.4.5-3","2.4.6-1","2.4.7-1","2.4.7-10","2.4.7-11","2.4.7-12","2.4.7-13","2.4.7-14","2.4.7-15","2.4.7-16","2.4.7-17","2.4.7-18","2.4.7-19","2.4.7-2","2.4.7-20","2.4.7-21","2.4.7-3","2.4.7-4","2.4.7-5","2.4.7-6","2.4.7-7","2.4.7-8","2.4.7-9","2.4.8-1","2.4.8-2","2.4.8-3","2.4.8-4","2.4.8-5","2.4.8-6","2.4.9-1","2.4.9-2","2.4.9-3","2.4.9-4","2.4.9-5","2.4.9-6","2.4.9-7","2.4.9-8"]},{"source":"osv","ecosystem":"Debian:13","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-21","2.4.7-21+deb13u1","2.4.8-1","2.4.8-2","2.4.8-3","2.4.8-4","2.4.8-5","2.4.8-6","2.4.9-1","2.4.9-2","2.4.9-3","2.4.9-4","2.4.9-5","2.4.9-6","2.4.9-7","2.4.9-8"]},{"source":"osv","ecosystem":"Debian:14","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-8"}]}],"versions":["2.4.7-21","2.4.8-1","2.4.8-2","2.4.8-3","2.4.8-4","2.4.8-5","2.4.8-6","2.4.9-1","2.4.9-2","2.4.9-3","2.4.9-4","2.4.9-5","2.4.9-6","2.4.9-7"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.32-11.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-17.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-17.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-17.oe2403sp4"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-18.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-dirmngr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-18.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-g13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-18.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-gpg-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-18.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-gpgconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-18.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-keyboxd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-18.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-scdaemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-18.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-smime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-18.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-18.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-verify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-18.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-wks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-18.1.hum1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.28-3ubuntu1","2.0.28-3ubuntu2","2.1.11-6ubuntu1","2.1.11-6ubuntu2","2.1.11-6ubuntu2.1","2.1.11-6ubuntu2.1+esm1","2.1.11-6ubuntu2.1+esm2","2.1.11-6ubuntu2.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.15-1ubuntu8","2.2.4-1ubuntu1","2.2.4-1ubuntu1.1","2.2.4-1ubuntu1.2","2.2.4-1ubuntu1.3","2.2.4-1ubuntu1.4","2.2.4-1ubuntu1.5","2.2.4-1ubuntu1.6","2.2.4-1ubuntu1.6+esm1","2.2.4-1ubuntu1.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.12-1ubuntu3","2.2.17-3ubuntu1","2.2.19-3ubuntu2","2.2.19-3ubuntu2.1","2.2.19-3ubuntu2.2","2.2.19-3ubuntu2.4","2.2.19-3ubuntu2.5","2.2.19-3ubuntu2.5+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.20-1ubuntu4","2.2.27-2ubuntu1","2.2.27-3ubuntu1","2.2.27-3ubuntu2","2.2.27-3ubuntu2.1","2.2.27-3ubuntu2.3","2.2.27-3ubuntu2.4","2.2.27-3ubuntu2.5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.40-1.1ubuntu1","2.4.4-2ubuntu7","2.4.4-2ubuntu15","2.4.4-2ubuntu16","2.4.4-2ubuntu17","2.4.4-2ubuntu17.2","2.4.4-2ubuntu17.3","2.4.4-2ubuntu17.4","2.4.4-2ubuntu17.6"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.8-4ubuntu3","2.4.9-4ubuntu1","2.4.9-4ubuntu2","2.4.9-4ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.8-2ubuntu2","2.4.8-4ubuntu1","2.4.8-4ubuntu2","2.4.8-4ubuntu3","2.4.8-4ubuntu3.1"]}],"products":[{"vendor":"gnupg","product":"gnupg"}],"references":[{"url":"https://static.dev.gnupg.org/T8159.html","tags":["web","article"]},{"url":"https://github.com/gpg/gnupg/commit/7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88","tags":["fix","article"]},{"url":"https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000504.html","tags":["web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105712","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-9w76-549g-prc8"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-105712","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1791488683.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105712.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-105712","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4360","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4361","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4362","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4363","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:77484","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-105712","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_77484.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2546069","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-105712","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2026-105712","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-105712","description":"gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.","status":"published","published":"2026-10-05T18:53:09.873Z","modified":"2026-10-05T19:09:30.98Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-61"],"updated_at":"2026-11-02T14:19:56.755658Z"}],"euvd":[{"id":"EUVD-2026-92634","description":"gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.","status":"published","published":"2026-10-05T18:53:09Z","modified":"2026-10-05T19:09:30Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"low"}],"updated_at":"2026-11-02T17:27:39.05741Z"}],"ghsa":[{"id":"GHSA-9w76-549g-prc8","title":"gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When...","description":"gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.","status":"published","published":"2026-10-05T21:31:34Z","modified":"2026-10-05T21:31:38Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"low"}],"cwes":["CWE-61"],"updated_at":"2026-11-02T15:12:48.668129Z"}],"nvd":[{"id":"CVE-2026-105712","description":"gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.","status":"published","published":"2026-10-05T19:17:19.527Z","modified":"2026-10-06T16:00:36.547Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"low","assessor":"secondary"}],"cwes":["CWE-61"],"updated_at":"2026-11-02T14:12:54.129949Z"}],"osv":[{"id":"BELL-CVE-2026-105712","status":"published","published":"2026-10-06T06:05:20.873048Z","modified":"2026-11-07T07:15:04.293302259Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"low"}],"updated_at":"2026-11-07T07:40:27.39378Z"},{"id":"CVE-2026-105712","description":"gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.","status":"published","published":"2026-10-05T18:53:09.873Z","modified":"2026-11-11T10:47:22.68013765Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"low"}],"cwes":["CWE-61"],"updated_at":"2026-11-11T03:22:04.464623Z"},{"id":"DEBIAN-CVE-2026-105712","description":"gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.","status":"published","published":"2026-10-05T19:17:19.527Z","modified":"2026-10-16T05:00:06.697924646Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"low"}],"updated_at":"2026-11-02T15:45:48.903138Z"},{"id":"OESA-2026-4360","title":"gnupg2 security update","description":"GnuPG is a complete and free implementation of the OpenPGP standard as defined by RFC4880 (also known as PGP).  GnuPG enables encryption and signing of data and communication, and features a versatile key management system as well as access modules for public key directories.\r\n\r\nSecurity Fix(es):\n\ngpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user\u0026apos;s filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.(CVE-2026-105712)","status":"published","published":"2026-10-16T11:59:46Z","modified":"2026-10-16T12:15:10.787019923Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"low"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4361","title":"gnupg2 security update","description":"GnuPG is a complete and free implementation of the OpenPGP standard as defined by RFC4880 (also known as PGP).  GnuPG enables encryption and signing of data and communication, and features a versatile key management system as well as access modules for public key directories.\r\n\r\nSecurity Fix(es):\n\ngpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user\u0026apos;s filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.(CVE-2026-105712)","status":"published","published":"2026-10-16T11:59:47Z","modified":"2026-10-16T12:15:10.089472315Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"low"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4362","title":"gnupg2 security update","description":"GnuPG is a complete and free implementation of the OpenPGP standard as defined by RFC4880 (also known as PGP).  GnuPG enables encryption and signing of data and communication, and features a versatile key management system as well as access modules for public key directories.\r\n\r\nSecurity Fix(es):\n\ngpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user\u0026apos;s filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.(CVE-2026-105712)","status":"published","published":"2026-10-16T11:59:47Z","modified":"2026-10-16T12:15:09.980514078Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"low"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4363","title":"gnupg2 security update","description":"GnuPG is a complete and free implementation of the OpenPGP standard as defined by RFC4880 (also known as PGP).  GnuPG enables encryption and signing of data and communication, and features a versatile key management system as well as access modules for public key directories.\r\n\r\nSecurity Fix(es):\n\ngpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user\u0026apos;s filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.(CVE-2026-105712)","status":"published","published":"2026-10-16T11:59:48Z","modified":"2026-10-16T12:15:10.790288498Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"low"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"RHSA-2026:77484","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-10-08T10:20:21Z","modified":"2026-10-08T10:30:15.737912415Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"low"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"UBUNTU-CVE-2026-105712","description":"gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.","status":"published","published":"2026-10-05T19:17:00Z","modified":"2026-10-17T12:59:47.832348033Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"low"}],"updated_at":"2026-11-02T16:55:59.130573Z"},{"id":"AZL-105962","title":"CVE-2026-105712 affecting package gnupg2 2.4.9-3","description":"gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.","status":"published","published":"2026-10-05T19:17:19Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.719431Z"},{"id":"CLSA-2026-1791488683","title":"Fix CVE(s): CVE-2026-105712","description":"   * SECURITY UPDATE: file overwrite via symlink in gpgtar extraction\n     - debian/patches/CVE-2026-105712.patch: refuse to extract with\n       --directory into a non-empty directory or a symlink.\n     - CVE-2026-105712","status":"published","published":"2026-10-08T19:44:53Z","modified":"2026-10-26T09:31:53.569653752Z","updated_at":"2026-11-02T15:43:49.016976Z"}]}}