{"id":"CVE-2026-18477","aliases":["ALSA-2026:61581","ALSA-2026:61586","ALSA-2026:70390","AZL-94602","CLSA-2026-1787335320","CLSA-2026-1787337920","DEBIAN-CVE-2026-18477","EUVD-2026-52336","GHSA-v7fx-gjvh-347c","JLSEC-2026-1344","MGASA-2026-0401","OESA-2026-3597","OESA-2026-3598","OESA-2026-3599","OESA-2026-3600","OESA-2026-3870","RHSA-2026:49361","RHSA-2026:61581","RHSA-2026:61586","RHSA-2026:70390","RLSA-2026:61581","RLSA-2026:61586","RLSA-2026:70390","UBUNTU-CVE-2026-18477"],"status":"published","title":"Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape","description":"A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue.","severity":{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00104,"percentile":0.01008,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-367"],"published":"2026-08-03T15:34:36Z","modified":"2026-11-05T20:17:52Z","fixes":[{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"tar","fixed_in":["2:1.34-7.el9.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"tar","fixed_in":["2:1.34-7.el9.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"tar","fixed_in":["1.35-7.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"tar","fixed_in":["1.35-7.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"tar","fixed_in":["1.32-7.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"tar","fixed_in":["1.34-9.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"tar","fixed_in":["1.35-7.oe2403sp4"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"tar","fixed_in":["0:1.35-9.1.hum1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.34-13.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.35-13.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.30-13.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Azure Linux:3","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.35-3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.34-7.el9.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.34-7.el9.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.34+dfsg-1.2","1.34+dfsg-1.2+deb12u1","1.34+dfsg-1.3","1.34+dfsg-1.4","1.35+dfsg-1","1.35+dfsg-2","1.35+dfsg-3","1.35+dfsg-3.1","1.35+dfsg-4","1.35+dfsg-5","1.35+dfsg-5+hurd.1","1.35+dfsg-6","1.35+dfsg-7"]},{"source":"osv","ecosystem":"Debian:13","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.35+dfsg-3.1","1.35+dfsg-4","1.35+dfsg-5","1.35+dfsg-5+hurd.1","1.35+dfsg-6","1.35+dfsg-7"]},{"source":"osv","ecosystem":"Debian:14","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.35+dfsg-3.1","1.35+dfsg-4","1.35+dfsg-5","1.35+dfsg-5+hurd.1","1.35+dfsg-6","1.35+dfsg-7"]},{"source":"osv","ecosystem":"Julia","package":"Tar_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"1.35.0+0"}]}]},{"source":"osv","ecosystem":"Mageia:10","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35-4.1.mga10"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:9","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35-4.1.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35-7.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35-7.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.32-7.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-9.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35-7.oe2403sp4"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.35-9.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.34-13.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"tar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.34-13.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"tar-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.34-13.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.35-13.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.35-13.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tar-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.35-13.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.30-13.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"tar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.30-13.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"tar-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.30-13.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.34-13.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:10","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.35-13.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.30-13.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26+dfsg-8","1.27-3","1.27-4","1.27.1-1","1.27.1-1ubuntu0.1","1.27.1-1ubuntu0.1+esm1","1.27.1-1ubuntu0.1+esm2","1.27.1-1ubuntu0.1+esm3","1.27.1-1ubuntu0.1+esm4","1.27.1-1ubuntu0.1+esm5","1.27.1-1ubuntu0.1+esm6","1.27.1-1ubuntu0.1+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.27.1-2","1.28-2ubuntu1","1.28-2.1","1.28-2.1ubuntu0.1","1.28-2.1ubuntu0.2","1.28-2.1ubuntu0.2+esm1","1.28-2.1ubuntu0.2+esm2","1.28-2.1ubuntu0.2+esm3","1.28-2.1ubuntu0.2+esm4","1.28-2.1ubuntu0.2+esm5","1.28-2.1ubuntu0.2+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.29b-2","1.29b-2ubuntu0.1","1.29b-2ubuntu0.2","1.29b-2ubuntu0.3","1.29b-2ubuntu0.4","1.29b-2ubuntu0.4+esm1","1.29b-2ubuntu0.4+esm2","1.29b-2ubuntu0.4+esm3","1.29b-2ubuntu0.4+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.30+dfsg-6","1.30+dfsg-7","1.30+dfsg-7ubuntu0.20.04.1","1.30+dfsg-7ubuntu0.20.04.2","1.30+dfsg-7ubuntu0.20.04.3","1.30+dfsg-7ubuntu0.20.04.4","1.30+dfsg-7ubuntu0.20.04.4+esm1","1.30+dfsg-7ubuntu0.20.04.4+esm2","1.30+dfsg-7ubuntu0.20.04.4+esm3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.34+dfsg-1build1","1.34+dfsg-1build2","1.34+dfsg-1build3","1.34+dfsg-1ubuntu0.1.22.04.1","1.34+dfsg-1ubuntu0.1.22.04.2","1.34+dfsg-1ubuntu0.1.22.04.3","1.34+dfsg-1ubuntu0.1.22.04.4","1.34+dfsg-1ubuntu0.1.22.04.5","1.34+dfsg-1ubuntu0.1.22.04.6"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.34+dfsg-1.2ubuntu1","1.34+dfsg-1.2ubuntu2","1.34+dfsg-1.3ubuntu1","1.34+dfsg-1.4","1.35+dfsg-2~build1","1.35+dfsg-2","1.35+dfsg-3","1.35+dfsg-3build1","1.35+dfsg-3ubuntu0.1","1.35+dfsg-3ubuntu0.2","1.35+dfsg-3ubuntu0.3","1.35+dfsg-3ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.35+dfsg-4","1.35+dfsg-5ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.35+dfsg-3.1build1","1.35+dfsg-3.1build2","1.35+dfsg-4","1.35+dfsg-4ubuntu0.1","1.35+dfsg-4ubuntu0.2","1.35+dfsg-4ubuntu0.3","1.35+dfsg-4ubuntu0.4"]}],"products":[{"vendor":"gnu","product":"tar"},{"vendor":"red hat","product":"red hat discovery 2"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift container platform 5"},{"vendor":"red hat","product":"red hat update infrastructure 5"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"openshift_container_platform"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:49361","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61581","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61586","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61783","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66018","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:70390","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-18477","tags":["vdb-entry","x_refsource_REDHAT","Vendor Advisory","report","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509735","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Vendor Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18477","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-v7fx-gjvh-347c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-18508","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-5704","tags":["report"]},{"url":"https://bugzilla.redhat.com/2455360","tags":["report"]},{"url":"https://bugzilla.redhat.com/2509735","tags":["report"]},{"url":"https://bugzilla.redhat.com/2509843","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-61581.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-61586.html","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-45582","tags":["report"]},{"url":"https://bugzilla.redhat.com/2379592","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-70390.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1787335320.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1787337920.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-18477","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0401.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36289","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ASLMG5TUYWS2IEKBCOWN5KZ2K55V366N/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3597","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3598","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3599","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3600","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3870","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49361.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18477","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2455360","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509843","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61581.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-5704","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5704","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18508","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18508","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/RHEL-143906","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61586.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2379592","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_70390.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-45582","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-45582","tags":["advisory"]},{"url":"https://github.com/i900008/vulndb/blob/main/Gnu_tar_vuln.md","tags":["article"]},{"url":"https://www.gnu.org/software/tar/","tags":["article"]},{"url":"https://www.gnu.org/software/tar/manual/html_node/Integrity.html#Integrity","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2026:61581","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:61586","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:70390","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-18477","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-18477","title":"Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape","description":"A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue.","status":"published","published":"2026-08-03T15:34:36.627Z","modified":"2026-11-05T19:25:25.764Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-367"],"updated_at":"2026-11-05T20:54:59.423743Z"}],"euvd":[{"id":"EUVD-2026-52336","description":"A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue.","status":"published","published":"2026-08-03T15:34:36Z","modified":"2026-11-05T19:25:25Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-05T20:01:48.21368Z"}],"ghsa":[{"id":"GHSA-v7fx-gjvh-347c","title":"A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename...","description":"A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue.","status":"published","published":"2026-08-03T18:30:47Z","modified":"2026-09-23T00:32:15Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T15:12:19.294085Z"}],"nvd":[{"id":"CVE-2026-18477","description":"A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue.","status":"published","published":"2026-08-03T17:16:33.897Z","modified":"2026-11-05T20:17:52.39Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-367"],"updated_at":"2026-11-05T21:56:42.883538Z"}],"osv":[{"id":"DEBIAN-CVE-2026-18477","description":"A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue.","status":"published","published":"2026-08-03T17:16:33.897Z","modified":"2026-10-31T10:01:23.566846697Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:53.097669Z"},{"id":"JLSEC-2026-1344","title":"TOCTOU in GNU tar allows unauthorized file modification by a local attacker","description":"A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue.","status":"published","published":"2026-08-18T00:06:39.509Z","modified":"2026-08-18T00:15:02.650576017Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"OESA-2026-3597","title":"tar security update","description":"GNU Tar provides the ability to create tar archives, as well as various other kinds of manipulation. For example, you can use Tar on previously created archives to extract files, to store additional files, or to update or list files which were already stored.\r\n\r\nSecurity Fix(es):\n\nA TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar\u0026apos;s incremental dumpdir \u0026apos;X\u0026apos; rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue.(CVE-2026-18477)","status":"published","published":"2026-09-05T15:03:00Z","modified":"2026-09-05T15:16:25.536668793Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3598","title":"tar security update","description":"GNU Tar provides the ability to create tar archives, as well as various other kinds of manipulation. For example, you can use Tar on previously created archives to extract files, to store additional files, or to update or list files which were already stored.\r\n\r\nSecurity Fix(es):\n\nA TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar\u0026apos;s incremental dumpdir \u0026apos;X\u0026apos; rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue.(CVE-2026-18477)","status":"published","published":"2026-09-05T15:03:01Z","modified":"2026-09-05T15:16:25.985058832Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3599","title":"tar security update","description":"GNU Tar provides the ability to create tar archives, as well as various other kinds of manipulation. For example, you can use Tar on previously created archives to extract files, to store additional files, or to update or list files which were already stored.\r\n\r\nSecurity Fix(es):\n\nA TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar\u0026apos;s incremental dumpdir \u0026apos;X\u0026apos; rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue.(CVE-2026-18477)","status":"published","published":"2026-09-05T15:03:01Z","modified":"2026-09-05T15:16:25.994195881Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3600","title":"tar security update","description":"GNU Tar provides the ability to create tar archives, as well as various other kinds of manipulation. For example, you can use Tar on previously created archives to extract files, to store additional files, or to update or list files which were already stored.\r\n\r\nSecurity Fix(es):\n\nA TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar\u0026apos;s incremental dumpdir \u0026apos;X\u0026apos; rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue.(CVE-2026-18477)","status":"published","published":"2026-09-05T15:03:02Z","modified":"2026-09-05T15:16:25.232784962Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3870","title":"tar security update","description":"GNU Tar provides the ability to create tar archives, as well as various other kinds of manipulation. For example, you can use Tar on previously created archives to extract files, to store additional files, or to update or list files which were already stored.\r\n\r\nSecurity Fix(es):\n\nA TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar\u0026apos;s incremental dumpdir \u0026apos;X\u0026apos; rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue.(CVE-2026-18477)","status":"published","published":"2026-09-14T16:35:11Z","modified":"2026-09-13T16:45:51.155754457Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"RHSA-2026:49361","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-08-05T10:36:59Z","modified":"2026-09-23T10:10:39Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:61581","title":"Red Hat Security Advisory: tar security, bug fix, and enhancement update","status":"published","published":"2026-09-01T10:28:29Z","modified":"2026-09-23T10:12:57Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:61586","title":"Red Hat Security Advisory: tar security, bug fix, and enhancement update","status":"published","published":"2026-09-02T10:22:02Z","modified":"2026-09-23T10:12:58Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:70390","title":"Red Hat Security Advisory: tar security, bug fix, and enhancement update","status":"published","published":"2026-09-23T10:15:22Z","modified":"2026-09-23T10:42:32.692411196Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RLSA-2026:61581","title":"Moderate: tar security, bug fix, and enhancement update","description":"The GNU tar program can save multiple files in an archive and restore files from an archive.\n\nSecurity Fix(es):\n\n* tar: tar: Hidden file injection via crafted archives (CVE-2026-5704)\n\n* tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape (CVE-2026-18477)\n\n* tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite (CVE-2026-18508)\n\nBug Fix(es) and Enhancement(s):\n\n* tar: --one-top-level with absolute path fails [rhel-9] (JIRA:Rocky Linux-144021)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-01T06:05:33.619213Z","modified":"2026-09-01T06:30:02.785483335Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:61586","title":"Moderate: tar security, bug fix, and enhancement update","description":"The GNU tar program can save multiple files in an archive and restore files from an archive.\n\nSecurity Fix(es):\n\n* tar: tar: Hidden file injection via crafted archives (CVE-2026-5704)\n\n* tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape (CVE-2026-18477)\n\n* tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite (CVE-2026-18508)\n\nBug Fix(es) and Enhancement(s):\n\n* tar: --one-top-level with absolute path fails (JIRA:Rocky Linux-143906)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-11T00:11:04.412973Z","modified":"2026-09-11T00:30:02.71912775Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:70390","title":"Moderate: tar security, bug fix, and enhancement update","description":"The GNU tar program can save multiple files in an archive and restore files from an archive.\n\nSecurity Fix(es):\n\n* tar: Tar path traversal (CVE-2025-45582)\n\n* tar: tar: Hidden file injection via crafted archives (CVE-2026-5704)\n\n* tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape (CVE-2026-18477)\n\n* tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite (CVE-2026-18508)\n\nBug Fix(es) and Enhancement(s):\n\n* tar: --one-top-level with absolute path fails [rhel-8.10.z] (JIRA:Rocky Linux-144019)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-24T06:01:09.673764Z","modified":"2026-09-24T06:30:02.6746523Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-18477","description":"A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue.","status":"published","published":"2026-08-03T17:16:00Z","modified":"2026-10-17T12:56:47.255072823Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:01.334185Z"},{"id":"ALSA-2026:61581","title":"Moderate: tar security, bug fix, and enhancement update","description":"The GNU tar program can save multiple files in an archive and restore files from an archive.  \n\nSecurity Fix(es):  \n\n  * tar: tar: Hidden file injection via crafted archives (CVE-2026-5704)\n  * tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape (CVE-2026-18477)\n  * tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite (CVE-2026-18508)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * tar: --one-top-level with absolute path fails [almalinux-9] (JIRA:AlmaLinux-144021)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-31T00:00:00Z","modified":"2026-10-29T11:32:08.045056998Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:61586","title":"Moderate: tar security, bug fix, and enhancement update","description":"The GNU tar program can save multiple files in an archive and restore files from an archive.  \n\nSecurity Fix(es):  \n\n  * tar: tar: Hidden file injection via crafted archives (CVE-2026-5704)\n  * tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape (CVE-2026-18477)\n  * tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite (CVE-2026-18508)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * tar: --one-top-level with absolute path fails (JIRA:AlmaLinux-143906)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-31T00:00:00Z","modified":"2026-10-29T11:30:49.11135287Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:70390","title":"Moderate: tar security, bug fix, and enhancement update","description":"The GNU tar program can save multiple files in an archive and restore files from an archive.  \n\nSecurity Fix(es):  \n\n  * tar: Tar path traversal (CVE-2025-45582)\n  * tar: tar: Hidden file injection via crafted archives (CVE-2026-5704)\n  * tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape (CVE-2026-18477)\n  * tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite (CVE-2026-18508)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * tar: --one-top-level with absolute path fails [almalinux-8.10.z] (JIRA:AlmaLinux-144019)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-22T00:00:00Z","modified":"2026-10-29T11:02:29.621934812Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"AZL-94602","title":"CVE-2026-18477 affecting package tar 1.35-3","description":"A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue.","status":"published","published":"2026-08-03T17:16:33Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.077208Z"},{"id":"CLSA-2026-1787335320","title":"tar: Fix of CVE-2026-18477","description":"- CVE-2026-18477: apply safer_name_suffix to incremental dumpdir 'X' entries so\n  the temporary directory template can no longer escape the extraction directory\n- use mkdtempat instead of mkdtemp so the 'X' temporary directory is created\n  relative to -C (backport of upstream d479b2cc)","status":"published","published":"2026-08-21T18:02:10Z","modified":"2026-10-26T09:31:30.260882791Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787337920","title":"tar: Fix of CVE-2026-18477","description":"- CVE-2026-18477: apply safer_name_suffix to incremental dumpdir 'X' entries so\n  the temporary directory template can no longer escape the extraction directory\n- use mkdtempat instead of mkdtemp so the 'X' temporary directory is created\n  relative to -C (backport of upstream d479b2cc)","status":"published","published":"2026-08-21T18:45:31Z","modified":"2026-10-26T09:30:36.647014626Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"MGASA-2026-0401","title":"Updated tar packages fix security vulnerabilities","description":"GNU Tar through 1.35 allows file overwrite via directory traversal in\ncrafted TAR archives, with a certain two-step process. (CVE-2025-45582)\nTar: toctou in incremental dumpdir 'x' rename handling allows restore\npath escape. (CVE-2026-18477)\nTar: --one-top-level hardlink targets not confined to top-level\ndirectory enabling arbitrary file overwrite. (CVE-2026-18508)\n","status":"published","published":"2026-09-14T16:26:35Z","modified":"2026-09-14T16:42:46.255057952Z","updated_at":"2026-11-02T15:49:43.795591Z"}]}}