{"id":"CVE-2026-18508","aliases":["ALSA-2026:61581","ALSA-2026:61586","ALSA-2026:70390","AZL-94599","CLSA-2026-1789128477","CLSA-2026-1789131413","DEBIAN-CVE-2026-18508","EUVD-2026-52327","GHSA-4f5j-wqjr-hx49","MGASA-2026-0401","OESA-2026-3911","OESA-2026-3912","OESA-2026-4081","RHSA-2026:50807","RHSA-2026:61581","RHSA-2026:61586","RHSA-2026:70390","RLSA-2026:61581","RLSA-2026:61586","RLSA-2026:70390","UBUNTU-CVE-2026-18508"],"status":"published","title":"Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite","description":"A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.","severity":{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00141,"percentile":0.03451,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-59"],"published":"2026-08-03T14:51:41Z","modified":"2026-11-05T20:17:52Z","fixes":[{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"tar","fixed_in":["2:1.34-7.el9.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"tar","fixed_in":["2:1.34-7.el9.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"tar","fixed_in":["1.35-8.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"tar","fixed_in":["1.35-8.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"tar","fixed_in":["1.35-8.oe2403sp4"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"tar","fixed_in":["0:1.35-9.2.hum1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.34-13.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.35-13.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.30-13.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Azure Linux:3","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.35-3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.34-7.el9.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.34-7.el9.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.34+dfsg-1.2","1.34+dfsg-1.2+deb12u1","1.34+dfsg-1.3","1.34+dfsg-1.4","1.35+dfsg-1","1.35+dfsg-2","1.35+dfsg-3","1.35+dfsg-3.1","1.35+dfsg-4","1.35+dfsg-5","1.35+dfsg-5+hurd.1","1.35+dfsg-6","1.35+dfsg-7"]},{"source":"osv","ecosystem":"Debian:13","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.35+dfsg-3.1","1.35+dfsg-4","1.35+dfsg-5","1.35+dfsg-5+hurd.1","1.35+dfsg-6","1.35+dfsg-7"]},{"source":"osv","ecosystem":"Debian:14","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.35+dfsg-3.1","1.35+dfsg-4","1.35+dfsg-5","1.35+dfsg-5+hurd.1","1.35+dfsg-6","1.35+dfsg-7"]},{"source":"osv","ecosystem":"Mageia:10","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35-4.1.mga10"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:9","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35-4.1.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35-8.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35-8.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35-8.oe2403sp4"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.35-9.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.34-13.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"tar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.34-13.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"tar-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.34-13.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.35-13.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.35-13.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tar-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.35-13.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.30-13.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"tar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.30-13.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"tar-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.30-13.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.34-13.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:10","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.35-13.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.30-13.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26+dfsg-8","1.27-3","1.27-4","1.27.1-1","1.27.1-1ubuntu0.1","1.27.1-1ubuntu0.1+esm1","1.27.1-1ubuntu0.1+esm2","1.27.1-1ubuntu0.1+esm3","1.27.1-1ubuntu0.1+esm4","1.27.1-1ubuntu0.1+esm5","1.27.1-1ubuntu0.1+esm6","1.27.1-1ubuntu0.1+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.27.1-2","1.28-2ubuntu1","1.28-2.1","1.28-2.1ubuntu0.1","1.28-2.1ubuntu0.2","1.28-2.1ubuntu0.2+esm1","1.28-2.1ubuntu0.2+esm2","1.28-2.1ubuntu0.2+esm3","1.28-2.1ubuntu0.2+esm4","1.28-2.1ubuntu0.2+esm5","1.28-2.1ubuntu0.2+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.29b-2","1.29b-2ubuntu0.1","1.29b-2ubuntu0.2","1.29b-2ubuntu0.3","1.29b-2ubuntu0.4","1.29b-2ubuntu0.4+esm1","1.29b-2ubuntu0.4+esm2","1.29b-2ubuntu0.4+esm3","1.29b-2ubuntu0.4+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.30+dfsg-6","1.30+dfsg-7","1.30+dfsg-7ubuntu0.20.04.1","1.30+dfsg-7ubuntu0.20.04.2","1.30+dfsg-7ubuntu0.20.04.3","1.30+dfsg-7ubuntu0.20.04.4","1.30+dfsg-7ubuntu0.20.04.4+esm1","1.30+dfsg-7ubuntu0.20.04.4+esm2","1.30+dfsg-7ubuntu0.20.04.4+esm3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.34+dfsg-1build1","1.34+dfsg-1build2","1.34+dfsg-1build3","1.34+dfsg-1ubuntu0.1.22.04.1","1.34+dfsg-1ubuntu0.1.22.04.2","1.34+dfsg-1ubuntu0.1.22.04.3","1.34+dfsg-1ubuntu0.1.22.04.4","1.34+dfsg-1ubuntu0.1.22.04.5","1.34+dfsg-1ubuntu0.1.22.04.6"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.34+dfsg-1.2ubuntu1","1.34+dfsg-1.2ubuntu2","1.34+dfsg-1.3ubuntu1","1.34+dfsg-1.4","1.35+dfsg-2~build1","1.35+dfsg-2","1.35+dfsg-3","1.35+dfsg-3build1","1.35+dfsg-3ubuntu0.1","1.35+dfsg-3ubuntu0.2","1.35+dfsg-3ubuntu0.3","1.35+dfsg-3ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.35+dfsg-4","1.35+dfsg-5ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.35+dfsg-3.1build1","1.35+dfsg-3.1build2","1.35+dfsg-4","1.35+dfsg-4ubuntu0.1","1.35+dfsg-4ubuntu0.2","1.35+dfsg-4ubuntu0.3","1.35+dfsg-4ubuntu0.4"]}],"products":[{"vendor":"gnu","product":"tar"},{"vendor":"red hat","product":"red hat discovery 2"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift container platform 5"},{"vendor":"red hat","product":"red hat update infrastructure 5"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"openshift_container_platform"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:50807","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61581","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61586","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61783","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66018","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:70390","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-18508","tags":["vdb-entry","x_refsource_REDHAT","Vendor Advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509843","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18508","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-4f5j-wqjr-hx49"},{"url":"https://access.redhat.com/security/cve/CVE-2026-18477","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-5704","tags":["report"]},{"url":"https://bugzilla.redhat.com/2455360","tags":["report"]},{"url":"https://bugzilla.redhat.com/2509735","tags":["report"]},{"url":"https://bugzilla.redhat.com/2509843","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-61581.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-61586.html","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-45582","tags":["report"]},{"url":"https://bugzilla.redhat.com/2379592","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-70390.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1789128477.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1789131413.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-18508","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0401.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36289","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ASLMG5TUYWS2IEKBCOWN5KZ2K55V366N/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3911","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3912","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4081","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50807.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18508","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2455360","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509735","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61581.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-5704","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5704","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18477","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18477","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/RHEL-143906","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61586.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2379592","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_70390.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-45582","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-45582","tags":["advisory"]},{"url":"https://github.com/i900008/vulndb/blob/main/Gnu_tar_vuln.md","tags":["article"]},{"url":"https://www.gnu.org/software/tar/","tags":["article"]},{"url":"https://www.gnu.org/software/tar/manual/html_node/Integrity.html#Integrity","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2026:61581","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:61586","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:70390","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-18508","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-18508","title":"Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite","description":"A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.","status":"published","published":"2026-08-03T14:51:41.34Z","modified":"2026-11-05T19:25:31.075Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-59"],"updated_at":"2026-11-05T20:54:59.423743Z"}],"euvd":[{"id":"EUVD-2026-52327","description":"A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.","status":"published","published":"2026-08-03T14:51:41Z","modified":"2026-11-05T19:25:31Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-05T20:01:48.21368Z"}],"ghsa":[{"id":"GHSA-4f5j-wqjr-hx49","title":"A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink...","description":"A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.","status":"published","published":"2026-08-03T18:30:45Z","modified":"2026-09-23T00:31:13Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T15:12:19.294085Z"}],"nvd":[{"id":"CVE-2026-18508","description":"A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.","status":"published","published":"2026-08-03T16:16:28.387Z","modified":"2026-11-05T20:17:52.95Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-59"],"updated_at":"2026-11-05T21:56:42.883538Z"}],"osv":[{"id":"DEBIAN-CVE-2026-18508","description":"A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.","status":"published","published":"2026-08-03T16:16:28.387Z","modified":"2026-10-31T10:00:58.79159449Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:53.097669Z"},{"id":"OESA-2026-3911","title":"tar security update","description":"GNU Tar provides the ability to create tar archives, as well as various other kinds of manipulation. For example, you can use Tar on previously created archives to extract files, to store additional files, or to update or list files which were already stored.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.(CVE-2026-18508)","status":"published","published":"2026-09-20T13:23:09Z","modified":"2026-09-20T13:30:26.119038987Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-3912","title":"tar security update","description":"GNU Tar provides the ability to create tar archives, as well as various other kinds of manipulation. For example, you can use Tar on previously created archives to extract files, to store additional files, or to update or list files which were already stored.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.(CVE-2026-18508)","status":"published","published":"2026-09-20T13:23:09Z","modified":"2026-09-20T13:30:24.60277339Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4081","title":"tar security update","description":"GNU Tar provides the ability to create tar archives, as well as various other kinds of manipulation. For example, you can use Tar on previously created archives to extract files, to store additional files, or to update or list files which were already stored.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.(CVE-2026-18508)","status":"published","published":"2026-09-25T01:28:10Z","modified":"2026-09-25T01:45:08.197813496Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"RHSA-2026:50807","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-08-08T10:13:02Z","modified":"2026-09-23T10:10:58Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:61581","title":"Red Hat Security Advisory: tar security, bug fix, and enhancement update","status":"published","published":"2026-09-01T10:28:29Z","modified":"2026-09-23T10:12:57Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:61586","title":"Red Hat Security Advisory: tar security, bug fix, and enhancement update","status":"published","published":"2026-09-02T10:22:02Z","modified":"2026-09-23T10:12:58Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:70390","title":"Red Hat Security Advisory: tar security, bug fix, and enhancement update","status":"published","published":"2026-09-23T10:15:22Z","modified":"2026-09-23T10:42:32.692411196Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RLSA-2026:61581","title":"Moderate: tar security, bug fix, and enhancement update","description":"The GNU tar program can save multiple files in an archive and restore files from an archive.\n\nSecurity Fix(es):\n\n* tar: tar: Hidden file injection via crafted archives (CVE-2026-5704)\n\n* tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape (CVE-2026-18477)\n\n* tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite (CVE-2026-18508)\n\nBug Fix(es) and Enhancement(s):\n\n* tar: --one-top-level with absolute path fails [rhel-9] (JIRA:Rocky Linux-144021)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-01T06:05:33.619213Z","modified":"2026-09-01T06:30:02.785483335Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:61586","title":"Moderate: tar security, bug fix, and enhancement update","description":"The GNU tar program can save multiple files in an archive and restore files from an archive.\n\nSecurity Fix(es):\n\n* tar: tar: Hidden file injection via crafted archives (CVE-2026-5704)\n\n* tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape (CVE-2026-18477)\n\n* tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite (CVE-2026-18508)\n\nBug Fix(es) and Enhancement(s):\n\n* tar: --one-top-level with absolute path fails (JIRA:Rocky Linux-143906)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-11T00:11:04.412973Z","modified":"2026-09-11T00:30:02.71912775Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:70390","title":"Moderate: tar security, bug fix, and enhancement update","description":"The GNU tar program can save multiple files in an archive and restore files from an archive.\n\nSecurity Fix(es):\n\n* tar: Tar path traversal (CVE-2025-45582)\n\n* tar: tar: Hidden file injection via crafted archives (CVE-2026-5704)\n\n* tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape (CVE-2026-18477)\n\n* tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite (CVE-2026-18508)\n\nBug Fix(es) and Enhancement(s):\n\n* tar: --one-top-level with absolute path fails [rhel-8.10.z] (JIRA:Rocky Linux-144019)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-24T06:01:09.673764Z","modified":"2026-09-24T06:30:02.6746523Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-18508","description":"A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.","status":"published","published":"2026-08-03T16:16:00Z","modified":"2026-10-17T12:56:47.255674368Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:01.334185Z"},{"id":"ALSA-2026:61581","title":"Moderate: tar security, bug fix, and enhancement update","description":"The GNU tar program can save multiple files in an archive and restore files from an archive.  \n\nSecurity Fix(es):  \n\n  * tar: tar: Hidden file injection via crafted archives (CVE-2026-5704)\n  * tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape (CVE-2026-18477)\n  * tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite (CVE-2026-18508)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * tar: --one-top-level with absolute path fails [almalinux-9] (JIRA:AlmaLinux-144021)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-31T00:00:00Z","modified":"2026-10-29T11:32:08.045056998Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:61586","title":"Moderate: tar security, bug fix, and enhancement update","description":"The GNU tar program can save multiple files in an archive and restore files from an archive.  \n\nSecurity Fix(es):  \n\n  * tar: tar: Hidden file injection via crafted archives (CVE-2026-5704)\n  * tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape (CVE-2026-18477)\n  * tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite (CVE-2026-18508)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * tar: --one-top-level with absolute path fails (JIRA:AlmaLinux-143906)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-31T00:00:00Z","modified":"2026-10-29T11:30:49.11135287Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:70390","title":"Moderate: tar security, bug fix, and enhancement update","description":"The GNU tar program can save multiple files in an archive and restore files from an archive.  \n\nSecurity Fix(es):  \n\n  * tar: Tar path traversal (CVE-2025-45582)\n  * tar: tar: Hidden file injection via crafted archives (CVE-2026-5704)\n  * tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape (CVE-2026-18477)\n  * tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite (CVE-2026-18508)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * tar: --one-top-level with absolute path fails [almalinux-8.10.z] (JIRA:AlmaLinux-144019)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-22T00:00:00Z","modified":"2026-10-29T11:02:29.621934812Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"AZL-94599","title":"CVE-2026-18508 affecting package tar 1.35-3","description":"A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.","status":"published","published":"2026-08-03T16:16:28Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.077208Z"},{"id":"CLSA-2026-1789128477","title":"tar: Fix of CVE-2026-18508","description":"- CVE-2026-18508: confine hard link targets to the --one-top-level directory,\n  so a crafted archive can no longer alias a file outside it; this also\n  repairs extraction of legitimate hard links under --one-top-level","status":"published","published":"2026-09-11T12:08:17Z","modified":"2026-10-26T09:30:47.622831553Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789131413","title":"tar: Fix of CVE-2026-18508","description":"- CVE-2026-18508: confine hard link targets to the --one-top-level directory,\n  so a crafted archive can no longer alias a file outside it; this also\n  repairs extraction of legitimate hard links under --one-top-level","status":"published","published":"2026-09-11T12:57:03Z","modified":"2026-10-26T09:31:34.862395946Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"MGASA-2026-0401","title":"Updated tar packages fix security vulnerabilities","description":"GNU Tar through 1.35 allows file overwrite via directory traversal in\ncrafted TAR archives, with a certain two-step process. (CVE-2025-45582)\nTar: toctou in incremental dumpdir 'x' rename handling allows restore\npath escape. (CVE-2026-18477)\nTar: --one-top-level hardlink targets not confined to top-level\ndirectory enabling arbitrary file overwrite. (CVE-2026-18508)\n","status":"published","published":"2026-09-14T16:26:35Z","modified":"2026-09-14T16:42:46.255057952Z","updated_at":"2026-11-02T15:49:43.795591Z"}]}}