{"id":"CVE-2026-42497","aliases":["ALPINE-CVE-2026-42497","AZL-89136","BELL-CVE-2026-42497","DEBIAN-CVE-2026-42497","EUVD-2026-31777","GHSA-fcfm-93gv-wh6f","MGASA-2026-0230","ROOT-OS-DEBIAN-11-CVE-2026-42497","ROOT-OS-DEBIAN-12-CVE-2026-42497","ROOT-OS-DEBIAN-13-CVE-2026-42497","UBUNTU-CVE-2026-42497"],"status":"published","title":"Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory","description":"Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.\n\nA subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00458,"percentile":0.39964,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-59","CWE-732"],"published":"2026-05-26T00:17:50Z","modified":"2026-11-09T12:49:53Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"perl","fixed_in":["5.42.3-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"perl","fixed_in":["5.38.2-510"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"perl","fixed_in":["5.36.3-r2"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"perl","fixed_in":["5.40.4-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"perl","fixed_in":["5.42.2-r1"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"perl","fixed_in":["5.36.3-r2"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"perl","fixed_in":["5.40.4-r1"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"perl","fixed_in":["5.42.2-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"perl","fixed_in":["5.36.0-7+deb12u4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"perl","fixed_in":["5.40.1-6+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"perl","fixed_in":["5.42.3-1"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"perl","fixed_in":["5.32.1-4+deb11u5.aikido.6","5.32.1-4+deb11u5.aikido.7","5.32.1-4+deb11u5.aikido.8","5.32.1-4+deb11u5.aikido.9","5.32.1-4+deb11u5.aikido.10","5.32.1-4+deb11u5.aikido.11","5.32.1-4+deb11u5.root.io.2","5.32.1-4+deb11u5.aikido.12","5.32.1-4+deb11u5.root.io.5","5.32.1-4+deb11u5.root.io.4"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-perl","fixed_in":["5.32.1-4+deb11u5.aikido.6","5.32.1-4+deb11u5.aikido.7","5.32.1-4+deb11u5.aikido.8","5.32.1-4+deb11u5.aikido.9","5.32.1-4+deb11u5.aikido.10","5.32.1-4+deb11u5.aikido.11","5.32.1-4+deb11u5.root.io.2","5.32.1-4+deb11u5.aikido.12","5.32.1-4+deb11u5.root.io.5","5.32.1-4+deb11u5.root.io.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"perl","fixed_in":["5.38.2-3.2ubuntu0.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.42.3-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.38.2-510"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.36.0-r0"},{"fixed":"5.36.3-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.40.2-r0"},{"fixed":"5.40.4-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.36.0-r0"},{"fixed":"5.42.2-r1"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.36.0-r0"},{"fixed":"5.36.3-r2"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.40.2-r0"},{"fixed":"5.40.4-r1"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.36.0-r0"},{"fixed":"5.42.2-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.36.0-7+deb12u4"}]}],"versions":["5.36.0-7","5.36.0-7+deb12u1","5.36.0-7+deb12u2","5.36.0-7+deb12u3"]},{"source":"osv","ecosystem":"Debian:13","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.40.1-6+deb13u1"}]}],"versions":["5.40.1-6"]},{"source":"osv","ecosystem":"Debian:14","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.42.3-1"}]}],"versions":["5.40.1-6","5.40.1-7","5.40.1-8","5.42.0-1","5.42.0-2","5.42.0-3","5.42.2-1","5.42.2-2","5.42.2-3"]},{"source":"osv","ecosystem":"Mageia:9","package":"perl-Archive-Tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.380.0-2.1.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"Root:Debian:11","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.32.1-4+deb11u5.aikido.6"},{"fixed":"5.32.1-4+deb11u5.aikido.7"},{"fixed":"5.32.1-4+deb11u5.aikido.8"},{"fixed":"5.32.1-4+deb11u5.aikido.9"},{"fixed":"5.32.1-4+deb11u5.aikido.10"},{"fixed":"5.32.1-4+deb11u5.aikido.11"},{"fixed":"5.32.1-4+deb11u5.root.io.2"},{"fixed":"5.32.1-4+deb11u5.aikido.12"},{"fixed":"5.32.1-4+deb11u5.root.io.5"},{"fixed":"5.32.1-4+deb11u5.root.io.4"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.32.1-4+deb11u5.aikido.6"},{"fixed":"5.32.1-4+deb11u5.aikido.7"},{"fixed":"5.32.1-4+deb11u5.aikido.8"},{"fixed":"5.32.1-4+deb11u5.aikido.9"},{"fixed":"5.32.1-4+deb11u5.aikido.10"},{"fixed":"5.32.1-4+deb11u5.aikido.11"},{"fixed":"5.32.1-4+deb11u5.root.io.2"},{"fixed":"5.32.1-4+deb11u5.aikido.12"},{"fixed":"5.32.1-4+deb11u5.root.io.5"},{"fixed":"5.32.1-4+deb11u5.root.io.4"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.14.2-21build1","5.18.1-4","5.18.1-4build1","5.18.1-5","5.18.2-2","5.18.2-2ubuntu1","5.18.2-2ubuntu1.1","5.18.2-2ubuntu1.3","5.18.2-2ubuntu1.4","5.18.2-2ubuntu1.6","5.18.2-2ubuntu1.7","5.18.2-2ubuntu1.7+esm3","5.18.2-2ubuntu1.7+esm4","5.18.2-2ubuntu1.7+esm5","5.18.2-2ubuntu1.7+esm7","5.18.2-2ubuntu1.7+esm8","5.18.2-2ubuntu1.7+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.20.2-6","5.22.1-3","5.22.1-4","5.22.1-5","5.22.1-7","5.22.1-8","5.22.1-9","5.22.1-9ubuntu0.2","5.22.1-9ubuntu0.3","5.22.1-9ubuntu0.5","5.22.1-9ubuntu0.6","5.22.1-9ubuntu0.9","5.22.1-9ubuntu0.9+esm1","5.22.1-9ubuntu0.9+esm2","5.22.1-9ubuntu0.9+esm3","5.22.1-9ubuntu0.9+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.26.0-8ubuntu1","5.26.1-2ubuntu1","5.26.1-3","5.26.1-4","5.26.1-4build1","5.26.1-5","5.26.1-6","5.26.1-6ubuntu0.1","5.26.1-6ubuntu0.2","5.26.1-6ubuntu0.3","5.26.1-6ubuntu0.5","5.26.1-6ubuntu0.6","5.26.1-6ubuntu0.7","5.26.1-6ubuntu0.7+esm2","5.26.1-6ubuntu0.7+esm3","5.26.1-6ubuntu0.7+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.28.1-6build1","5.30.0-7","5.30.0-9","5.30.0-9build1","5.30.0-9ubuntu0.2","5.30.0-9ubuntu0.3","5.30.0-9ubuntu0.4","5.30.0-9ubuntu0.5","5.30.0-9ubuntu0.5+esm2","5.30.0-9ubuntu0.5+esm3","5.30.0-9ubuntu0.5+esm4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.38.2-3.2ubuntu0.3"}]}],"versions":["5.36.0-9ubuntu1","5.36.0-10ubuntu1","5.38.2-3","5.38.2-3.2","5.38.2-3.2build1","5.38.2-3.2build2","5.38.2-3.2build2.1","5.38.2-3.2ubuntu0.1","5.38.2-3.2ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.40.1-2","5.40.1-3","5.40.1-5","5.40.1-6","5.40.1-6build1","5.40.1-6ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.40.1-7build1","5.40.1-8","5.40.1-8ubuntu1","5.42.3-1"]}],"products":[{"vendor":"archive\\","product":"\\"},{"vendor":"bingos","product":"archive::tar"}],"references":[{"url":"https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch","tags":["patch","Patch","fix","report"]},{"url":"https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes","tags":["release-notes","Release Notes","advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42496","tags":["related","Third Party Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42497","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-fcfm-93gv-wh6f"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-42497","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-42497","tags":["advisory"]},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42497.json","tags":["advisory"]},{"url":"https://github.com/jib/archive-tar-new","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-42497","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0230.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35587","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/26/2","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/26/3","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/26/4","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-42497","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42497","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/40396457/","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-42497","title":"Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory","description":"Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.\n\nA subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.","status":"published","published":"2026-05-26T00:17:50.656Z","modified":"2026-05-28T13:14:01.484Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-59","CWE-732"],"updated_at":"2026-11-02T13:40:23.731501Z"}],"euvd":[{"id":"EUVD-2026-31777","description":"Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.\n\nA subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.","status":"published","published":"2026-05-26T00:17:50Z","modified":"2026-05-28T13:14:01Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T18:21:03.0662Z"}],"ghsa":[{"id":"GHSA-fcfm-93gv-wh6f","title":"Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside...","description":"Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.\n\nA subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.","status":"published","published":"2026-05-26T13:30:53Z","modified":"2026-05-27T21:31:24Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T15:08:21.544183Z"}],"nvd":[{"id":"CVE-2026-42497","description":"Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.\n\nA subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.","status":"published","published":"2026-05-26T02:16:40.25Z","modified":"2026-07-24T11:10:00.17Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-59","CWE-732"],"updated_at":"2026-11-02T14:12:20.131508Z"}],"osv":[{"id":"ALPINE-CVE-2026-42497","description":"Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.\n\nA subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.","status":"published","published":"2026-05-26T02:16:40.25Z","modified":"2026-11-03T19:30:02.816057485Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T20:03:57.215693Z"},{"id":"BELL-CVE-2026-42497","status":"published","published":"2026-05-28T06:11:40.55924Z","modified":"2026-06-03T07:15:25.770729941Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:23.844435Z"},{"id":"CVE-2026-42497","title":"Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory","description":"Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.\n\nA subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.","status":"published","published":"2026-05-26T00:17:50.656Z","modified":"2026-10-28T02:31:05.149650876Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-59","CWE-732"],"updated_at":"2026-11-02T15:45:04.117819Z"},{"id":"DEBIAN-CVE-2026-42497","description":"Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.  _make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.  A subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.","status":"published","published":"2026-05-26T02:16:40.25Z","modified":"2026-10-05T10:00:06.397691097Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:55.251751Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-42497","title":"CVE-2026-42497 in perl - Patched by Root","description":"Root has patched CVE-2026-42497 in the perl package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-08-23T08:42:48Z","modified":"2026-08-23T10:16:24.902277941Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:29.900552Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-42497","title":"CVE-2026-42497 in perl - Patched by Root","description":"Root has patched CVE-2026-42497 in the perl package for Root:Debian:12. Multiple fixed versions available.","status":"withdrawn","published":"2026-09-28T14:31:33Z","modified":"2026-10-08T19:00:05.891563221Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:32.037361Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-42497","title":"CVE-2026-42497 in perl - Patched by Root","description":"Root has patched CVE-2026-42497 in the perl package for Root:Debian:13. Multiple fixed versions available.","status":"withdrawn","published":"2026-08-24T16:37:37Z","modified":"2026-09-16T20:00:04.575845505Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:33.681527Z"},{"id":"UBUNTU-CVE-2026-42497","description":"Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory. _make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode. A subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.","status":"published","published":"2026-05-26T02:16:00Z","modified":"2026-11-09T12:49:53.431673404Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-09T13:27:42.046613Z"},{"id":"AZL-89136","title":"CVE-2026-42497 affecting package perl for versions less than 5.38.2-510","description":"Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.\n\nA subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.","status":"published","published":"2026-05-26T02:16:40Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.436971Z"},{"id":"MGASA-2026-0230","title":"Updated perl-Archive-Tar package fixes security vulnerabilities","description":"The updated package fixes security vulnerabilities:\nArchive::Tar versions before 3.08 for Perl extract symlinks with\nattacker controlled targets outside the extraction directory.\n(CVE-2026-42496)\nArchive::Tar versions before 3.08 for Perl extract hardlinks to attacker\ncontrolled paths outside the extraction directory. (CVE-2026-42497)\nArchive::Tar versions before 3.10 for Perl allow memory exhaustion via\nattacker controlled entry size field in tar header. (CVE-2026-9538)\n","status":"published","published":"2026-06-24T05:41:50Z","modified":"2026-06-24T05:45:04.552351896Z","updated_at":"2026-11-02T15:49:43.795591Z"}]}}