{"id":"CVE-2026-5704","aliases":["ALSA-2026:61581","ALSA-2026:61586","ALSA-2026:70390","AZL-98237","CLSA-2026-1791450288","CLSA-2026-1791452899","DEBIAN-CVE-2026-5704","EUVD-2026-19317","GHSA-jqqw-37x4-9rwj","MGASA-2026-0168","OESA-2026-3223","RHSA-2026:61581","RHSA-2026:61586","RHSA-2026:66514","RHSA-2026:70390","RLSA-2026:61581","RLSA-2026:61586","RLSA-2026:70390","ROOT-OS-DEBIAN-12-CVE-2026-5704","ROOT-OS-DEBIAN-13-CVE-2026-5704","ROOT-OS-UBUNTU-2204-CVE-2026-5704","ROOT-OS-UBUNTU-2404-CVE-2026-5704","SUSE-SU-2026:22289-1","SUSE-SU-2026:22377-1","SUSE-SU-2026:2714-1","UBUNTU-CVE-2026-5704","USN-8477-1","USN-8477-2","USN-8477-3","openSUSE-SU-2026:11125-1","openSUSE-SU-2026:21070-1"],"status":"published","title":"Tar: tar: hidden file injection via crafted archives","description":"A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.","severity":{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00473,"percentile":0.41165,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-434"],"published":"2026-04-06T15:17:27Z","modified":"2026-11-05T23:16:55Z","fixes":[{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"tar","fixed_in":["2:1.34-7.el9.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"tar","fixed_in":["2:1.34-7.el9.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"tar","fixed_in":["1.35-4.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"tar","fixed_in":["1.35-6.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"tar","fixed_in":["1.35-6.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"tar","fixed_in":["1.35-6.oe2403sp4"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"tar","fixed_in":["1.32-6.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"tar","fixed_in":["1.34-8.oe2203sp4"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"tar","fixed_in":["0:1.35-10.hum1"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"tar","fixed_in":["1.34+dfsg-1.2+deb12u1.aikido.2","1.34+dfsg-1.2+deb12u1.root.io.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-tar","fixed_in":["1.34+dfsg-1.2+deb12u1.aikido.2","1.34+dfsg-1.2+deb12u1.root.io.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"tar","fixed_in":["1.35+dfsg-3.1.aikido.3","1.35+dfsg-3.1.root.io.2"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"rootio-tar","fixed_in":["1.35+dfsg-3.1.aikido.3","1.35+dfsg-3.1.root.io.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"tar","fixed_in":["1.34-150000.3.42.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"tar","fixed_in":["1.34-150000.3.42.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"tar","fixed_in":["1.34-150000.3.42.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"tar","fixed_in":["1.34-150000.3.42.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"tar","fixed_in":["1.34-150000.3.42.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"tar","fixed_in":["1.34-150000.3.42.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"tar","fixed_in":["1.34-150000.3.42.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"tar","fixed_in":["1.34-150000.3.42.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"tar","fixed_in":["1.34-150000.3.42.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"tar","fixed_in":["1.34-150000.3.42.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"tar","fixed_in":["1.34-150000.3.42.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"tar","fixed_in":["1.34-150000.3.42.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"tar","fixed_in":["1.34-150000.3.42.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"tar","fixed_in":["1.34-150000.3.42.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tar","fixed_in":["1.27.1-1ubuntu0.1+esm7","1.27.1-1ubuntu0.1+esm5","1.27.1-1ubuntu0.1+esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tar","fixed_in":["1.28-2.1ubuntu0.2+esm6","1.28-2.1ubuntu0.2+esm4","1.28-2.1ubuntu0.2+esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tar","fixed_in":["1.29b-2ubuntu0.4+esm4","1.29b-2ubuntu0.4+esm2","1.29b-2ubuntu0.4+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"tar","fixed_in":["1.30+dfsg-7ubuntu0.20.04.4+esm3","1.30+dfsg-7ubuntu0.20.04.4+esm1","1.30+dfsg-7ubuntu0.20.04.4+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"tar","fixed_in":["1.34+dfsg-1ubuntu0.1.22.04.6","1.34+dfsg-1ubuntu0.1.22.04.3","1.34+dfsg-1ubuntu0.1.22.04.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"tar","fixed_in":["1.35+dfsg-3ubuntu0.4","1.35+dfsg-3ubuntu0.1","1.35+dfsg-3ubuntu0.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"tar","fixed_in":["1.35+dfsg-4ubuntu0.4","1.35+dfsg-4ubuntu0.1","1.35+dfsg-4ubuntu0.3"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"tar","fixed_in":["1.35-8.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.34-13.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.35-13.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.30-13.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Azure Linux:3","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.35-2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.34-7.el9.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.34-7.el9.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.34+dfsg-1.2","1.34+dfsg-1.2+deb12u1","1.34+dfsg-1.3","1.34+dfsg-1.4","1.35+dfsg-1","1.35+dfsg-2","1.35+dfsg-3","1.35+dfsg-3.1","1.35+dfsg-4","1.35+dfsg-5","1.35+dfsg-5+hurd.1","1.35+dfsg-6","1.35+dfsg-7"]},{"source":"osv","ecosystem":"Debian:13","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.35+dfsg-3.1","1.35+dfsg-4","1.35+dfsg-5","1.35+dfsg-5+hurd.1","1.35+dfsg-6","1.35+dfsg-7"]},{"source":"osv","ecosystem":"Debian:14","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.35+dfsg-3.1","1.35+dfsg-4","1.35+dfsg-5","1.35+dfsg-5+hurd.1","1.35+dfsg-6","1.35+dfsg-7"]},{"source":"osv","ecosystem":"Mageia:9","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35-4.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35-6.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35-6.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35-6.oe2403sp4"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.32-6.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-8.oe2203sp4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.34-13.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"tar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.34-13.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"tar-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.34-13.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.35-13.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.35-13.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tar-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.35-13.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.35-10.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.30-13.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"tar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.30-13.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"tar-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.30-13.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.34-13.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:10","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.35-13.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.30-13.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Root:Debian:12","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34+dfsg-1.2+deb12u1.aikido.2"},{"fixed":"1.34+dfsg-1.2+deb12u1.root.io.1"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34+dfsg-1.2+deb12u1.aikido.2"},{"fixed":"1.34+dfsg-1.2+deb12u1.root.io.1"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35+dfsg-3.1.aikido.3"},{"fixed":"1.35+dfsg-3.1.root.io.2"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"rootio-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35+dfsg-3.1.aikido.3"},{"fixed":"1.35+dfsg-3.1.root.io.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35-160000.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35-160000.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35-160000.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.42.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.42.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.42.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.42.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.42.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.42.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.42.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.42.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.42.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.42.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.42.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.42.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.42.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.42.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.1-1ubuntu0.1+esm7"}]}],"versions":["1.26+dfsg-8","1.27-3","1.27-4","1.27.1-1","1.27.1-1ubuntu0.1","1.27.1-1ubuntu0.1+esm1","1.27.1-1ubuntu0.1+esm2","1.27.1-1ubuntu0.1+esm3","1.27.1-1ubuntu0.1+esm4","1.27.1-1ubuntu0.1+esm5","1.27.1-1ubuntu0.1+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28-2.1ubuntu0.2+esm6"}]}],"versions":["1.27.1-2","1.28-2ubuntu1","1.28-2.1","1.28-2.1ubuntu0.1","1.28-2.1ubuntu0.2","1.28-2.1ubuntu0.2+esm1","1.28-2.1ubuntu0.2+esm2","1.28-2.1ubuntu0.2+esm3","1.28-2.1ubuntu0.2+esm4","1.28-2.1ubuntu0.2+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29b-2ubuntu0.4+esm4"}]}],"versions":["1.29b-2","1.29b-2ubuntu0.1","1.29b-2ubuntu0.2","1.29b-2ubuntu0.3","1.29b-2ubuntu0.4","1.29b-2ubuntu0.4+esm1","1.29b-2ubuntu0.4+esm2","1.29b-2ubuntu0.4+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30+dfsg-7ubuntu0.20.04.4+esm3"}]}],"versions":["1.30+dfsg-6","1.30+dfsg-7","1.30+dfsg-7ubuntu0.20.04.1","1.30+dfsg-7ubuntu0.20.04.2","1.30+dfsg-7ubuntu0.20.04.3","1.30+dfsg-7ubuntu0.20.04.4","1.30+dfsg-7ubuntu0.20.04.4+esm1","1.30+dfsg-7ubuntu0.20.04.4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34+dfsg-1ubuntu0.1.22.04.6"}]}],"versions":["1.34+dfsg-1build1","1.34+dfsg-1build2","1.34+dfsg-1build3","1.34+dfsg-1ubuntu0.1.22.04.1","1.34+dfsg-1ubuntu0.1.22.04.2","1.34+dfsg-1ubuntu0.1.22.04.3","1.34+dfsg-1ubuntu0.1.22.04.4","1.34+dfsg-1ubuntu0.1.22.04.5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35+dfsg-3ubuntu0.4"}]}],"versions":["1.34+dfsg-1.2ubuntu1","1.34+dfsg-1.2ubuntu2","1.34+dfsg-1.3ubuntu1","1.34+dfsg-1.4","1.35+dfsg-2~build1","1.35+dfsg-2","1.35+dfsg-3","1.35+dfsg-3build1","1.35+dfsg-3ubuntu0.1","1.35+dfsg-3ubuntu0.2","1.35+dfsg-3ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.35+dfsg-3.1","1.35+dfsg-3.1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35+dfsg-4ubuntu0.4"}]}],"versions":["1.35+dfsg-3.1build1","1.35+dfsg-3.1build2","1.35+dfsg-4","1.35+dfsg-4ubuntu0.1","1.35+dfsg-4ubuntu0.2","1.35+dfsg-4ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.1-1ubuntu0.1+esm5"}]}],"versions":["1.26+dfsg-8","1.27-3","1.27-4","1.27.1-1","1.27.1-1ubuntu0.1","1.27.1-1ubuntu0.1+esm1","1.27.1-1ubuntu0.1+esm2","1.27.1-1ubuntu0.1+esm3","1.27.1-1ubuntu0.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28-2.1ubuntu0.2+esm4"}]}],"versions":["1.27.1-2","1.28-2ubuntu1","1.28-2.1","1.28-2.1ubuntu0.1","1.28-2.1ubuntu0.2","1.28-2.1ubuntu0.2+esm1","1.28-2.1ubuntu0.2+esm2","1.28-2.1ubuntu0.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29b-2ubuntu0.4+esm2"}]}],"versions":["1.29b-2","1.29b-2ubuntu0.1","1.29b-2ubuntu0.2","1.29b-2ubuntu0.3","1.29b-2ubuntu0.4","1.29b-2ubuntu0.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30+dfsg-7ubuntu0.20.04.4+esm1"}]}],"versions":["1.30+dfsg-6","1.30+dfsg-7","1.30+dfsg-7ubuntu0.20.04.1","1.30+dfsg-7ubuntu0.20.04.2","1.30+dfsg-7ubuntu0.20.04.3","1.30+dfsg-7ubuntu0.20.04.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34+dfsg-1ubuntu0.1.22.04.3"}]}],"versions":["1.34+dfsg-1build1","1.34+dfsg-1build2","1.34+dfsg-1build3","1.34+dfsg-1ubuntu0.1.22.04.1","1.34+dfsg-1ubuntu0.1.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35+dfsg-3ubuntu0.1"}]}],"versions":["1.34+dfsg-1.2ubuntu1","1.34+dfsg-1.2ubuntu2","1.34+dfsg-1.3ubuntu1","1.34+dfsg-1.4","1.35+dfsg-2~build1","1.35+dfsg-2","1.35+dfsg-3","1.35+dfsg-3build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35+dfsg-4ubuntu0.1"}]}],"versions":["1.35+dfsg-3.1build1","1.35+dfsg-3.1build2","1.35+dfsg-4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.1-1ubuntu0.1+esm6"}]}],"versions":["1.26+dfsg-8","1.27-3","1.27-4","1.27.1-1","1.27.1-1ubuntu0.1","1.27.1-1ubuntu0.1+esm1","1.27.1-1ubuntu0.1+esm2","1.27.1-1ubuntu0.1+esm3","1.27.1-1ubuntu0.1+esm4","1.27.1-1ubuntu0.1+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28-2.1ubuntu0.2+esm5"}]}],"versions":["1.27.1-2","1.28-2ubuntu1","1.28-2.1","1.28-2.1ubuntu0.1","1.28-2.1ubuntu0.2","1.28-2.1ubuntu0.2+esm1","1.28-2.1ubuntu0.2+esm2","1.28-2.1ubuntu0.2+esm3","1.28-2.1ubuntu0.2+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29b-2ubuntu0.4+esm3"}]}],"versions":["1.29b-2","1.29b-2ubuntu0.1","1.29b-2ubuntu0.2","1.29b-2ubuntu0.3","1.29b-2ubuntu0.4","1.29b-2ubuntu0.4+esm1","1.29b-2ubuntu0.4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30+dfsg-7ubuntu0.20.04.4+esm2"}]}],"versions":["1.30+dfsg-6","1.30+dfsg-7","1.30+dfsg-7ubuntu0.20.04.1","1.30+dfsg-7ubuntu0.20.04.2","1.30+dfsg-7ubuntu0.20.04.3","1.30+dfsg-7ubuntu0.20.04.4","1.30+dfsg-7ubuntu0.20.04.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34+dfsg-1ubuntu0.1.22.04.5"}]}],"versions":["1.34+dfsg-1build1","1.34+dfsg-1build2","1.34+dfsg-1build3","1.34+dfsg-1ubuntu0.1.22.04.1","1.34+dfsg-1ubuntu0.1.22.04.2","1.34+dfsg-1ubuntu0.1.22.04.3","1.34+dfsg-1ubuntu0.1.22.04.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35+dfsg-3ubuntu0.3"}]}],"versions":["1.34+dfsg-1.2ubuntu1","1.34+dfsg-1.2ubuntu2","1.34+dfsg-1.3ubuntu1","1.34+dfsg-1.4","1.35+dfsg-2~build1","1.35+dfsg-2","1.35+dfsg-3","1.35+dfsg-3build1","1.35+dfsg-3ubuntu0.1","1.35+dfsg-3ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35+dfsg-4ubuntu0.3"}]}],"versions":["1.35+dfsg-3.1build1","1.35+dfsg-3.1build2","1.35+dfsg-4","1.35+dfsg-4ubuntu0.1","1.35+dfsg-4ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.1-1ubuntu0.1+esm7"}]}],"versions":["1.26+dfsg-8","1.27-3","1.27-4","1.27.1-1","1.27.1-1ubuntu0.1","1.27.1-1ubuntu0.1+esm1","1.27.1-1ubuntu0.1+esm2","1.27.1-1ubuntu0.1+esm3","1.27.1-1ubuntu0.1+esm4","1.27.1-1ubuntu0.1+esm5","1.27.1-1ubuntu0.1+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28-2.1ubuntu0.2+esm6"}]}],"versions":["1.27.1-2","1.28-2ubuntu1","1.28-2.1","1.28-2.1ubuntu0.1","1.28-2.1ubuntu0.2","1.28-2.1ubuntu0.2+esm1","1.28-2.1ubuntu0.2+esm2","1.28-2.1ubuntu0.2+esm3","1.28-2.1ubuntu0.2+esm4","1.28-2.1ubuntu0.2+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29b-2ubuntu0.4+esm4"}]}],"versions":["1.29b-2","1.29b-2ubuntu0.1","1.29b-2ubuntu0.2","1.29b-2ubuntu0.3","1.29b-2ubuntu0.4","1.29b-2ubuntu0.4+esm1","1.29b-2ubuntu0.4+esm2","1.29b-2ubuntu0.4+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30+dfsg-7ubuntu0.20.04.4+esm3"}]}],"versions":["1.30+dfsg-6","1.30+dfsg-7","1.30+dfsg-7ubuntu0.20.04.1","1.30+dfsg-7ubuntu0.20.04.2","1.30+dfsg-7ubuntu0.20.04.3","1.30+dfsg-7ubuntu0.20.04.4","1.30+dfsg-7ubuntu0.20.04.4+esm1","1.30+dfsg-7ubuntu0.20.04.4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34+dfsg-1ubuntu0.1.22.04.6"}]}],"versions":["1.34+dfsg-1build1","1.34+dfsg-1build2","1.34+dfsg-1build3","1.34+dfsg-1ubuntu0.1.22.04.1","1.34+dfsg-1ubuntu0.1.22.04.2","1.34+dfsg-1ubuntu0.1.22.04.3","1.34+dfsg-1ubuntu0.1.22.04.4","1.34+dfsg-1ubuntu0.1.22.04.5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35+dfsg-3ubuntu0.4"}]}],"versions":["1.34+dfsg-1.2ubuntu1","1.34+dfsg-1.2ubuntu2","1.34+dfsg-1.3ubuntu1","1.34+dfsg-1.4","1.35+dfsg-2~build1","1.35+dfsg-2","1.35+dfsg-3","1.35+dfsg-3build1","1.35+dfsg-3ubuntu0.1","1.35+dfsg-3ubuntu0.2","1.35+dfsg-3ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35+dfsg-4ubuntu0.4"}]}],"versions":["1.35+dfsg-3.1build1","1.35+dfsg-3.1build2","1.35+dfsg-4","1.35+dfsg-4ubuntu0.1","1.35+dfsg-4ubuntu0.2","1.35+dfsg-4ubuntu0.3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35-8.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35-160000.4.1"}]}],"bundled":2}],"products":[{"vendor":"gnu","product":"tar"},{"vendor":"red hat","product":"red hat discovery 2"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat update infrastructure 5"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"hardened_images"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:61581","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61586","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61783","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66018","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66514","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:70390","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-5704","tags":["vdb-entry","x_refsource_REDHAT","Third Party Advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2455360","tags":["issue-tracking","x_refsource_REDHAT","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/04/11/10","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/04/11/11","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/04/12/2","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5704","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-jqqw-37x4-9rwj"},{"url":"https://access.redhat.com/security/cve/CVE-2026-18477","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-18508","tags":["report"]},{"url":"https://bugzilla.redhat.com/2455360","tags":["report"]},{"url":"https://bugzilla.redhat.com/2509735","tags":["report"]},{"url":"https://bugzilla.redhat.com/2509843","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-61581.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-61586.html","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-45582","tags":["report"]},{"url":"https://bugzilla.redhat.com/2379592","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-70390.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1791450288.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1791452899.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-5704","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0168.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35350","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/04/11/10","tags":["web"]},{"url":"https://lists.gnu.org/archive/html/bug-tar/2026-03/msg00007.html","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3223","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509735","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509843","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61581.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-5704","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18477","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18477","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18508","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18508","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/RHEL-143906","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61586.json","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66514.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2379592","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_70390.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-45582","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-45582","tags":["advisory"]},{"url":"https://github.com/i900008/vulndb/blob/main/Gnu_tar_vuln.md","tags":["article"]},{"url":"https://www.gnu.org/software/tar/","tags":["article"]},{"url":"https://www.gnu.org/software/tar/manual/html_node/Integrity.html#Integrity","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2026:61581","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:61586","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:70390","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622289-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1261900","tags":["report"]},{"url":"https://bugzilla.suse.com/1265450","tags":["report"]},{"url":"https://bugzilla.suse.com/1267189","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-45582","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5704","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622377-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262714-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-5704","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8477-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8477-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8477-3","tags":["advisory"]},{"url":"https://launchpad.net/bugs/2160650","tags":["report"]},{"url":"https://launchpad.net/bugs/2161311","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-5704","title":"Tar: tar: hidden file injection via crafted archives","description":"A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.","status":"published","published":"2026-04-06T15:17:27.945Z","modified":"2026-11-05T22:15:54.938Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-434"],"updated_at":"2026-11-05T23:55:29.66083Z"}],"euvd":[{"id":"EUVD-2026-19317","description":"A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.","status":"published","published":"2026-04-06T15:17:27Z","modified":"2026-11-05T22:15:54Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-05T23:02:19.769742Z"}],"ghsa":[{"id":"GHSA-jqqw-37x4-9rwj","title":"A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a...","description":"A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.","status":"published","published":"2026-04-06T18:33:08Z","modified":"2026-09-23T00:31:13Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T15:12:19.294085Z"}],"nvd":[{"id":"CVE-2026-5704","description":"A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.","status":"published","published":"2026-04-06T16:16:42.14Z","modified":"2026-11-05T23:16:55.62Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-434"],"updated_at":"2026-11-06T01:57:38.479473Z"}],"osv":[{"id":"DEBIAN-CVE-2026-5704","description":"A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.","status":"published","published":"2026-04-06T16:16:42.14Z","modified":"2026-10-27T10:02:10.180230273Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:57.590991Z"},{"id":"OESA-2026-3223","title":"tar security update","description":"GNU Tar provides the ability to create tar archives, as well as various other kinds of manipulation. For example, you can use Tar on previously created archives to extract files, to store additional files, or to update or list files which were already stored.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.(CVE-2026-5704)","status":"published","published":"2026-08-01T11:12:05Z","modified":"2026-08-18T01:21:26.017804359Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"RHSA-2026:61581","title":"Red Hat Security Advisory: tar security, bug fix, and enhancement update","status":"published","published":"2026-09-01T10:28:29Z","modified":"2026-09-23T10:12:57Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:61586","title":"Red Hat Security Advisory: tar security, bug fix, and enhancement update","status":"published","published":"2026-09-02T10:22:02Z","modified":"2026-09-23T10:12:58Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:66514","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-11T10:15:16Z","modified":"2026-09-23T10:14:02Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:70390","title":"Red Hat Security Advisory: tar security, bug fix, and enhancement update","status":"published","published":"2026-09-23T10:15:22Z","modified":"2026-09-23T10:42:32.692411196Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RLSA-2026:61581","title":"Moderate: tar security, bug fix, and enhancement update","description":"The GNU tar program can save multiple files in an archive and restore files from an archive.\n\nSecurity Fix(es):\n\n* tar: tar: Hidden file injection via crafted archives (CVE-2026-5704)\n\n* tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape (CVE-2026-18477)\n\n* tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite (CVE-2026-18508)\n\nBug Fix(es) and Enhancement(s):\n\n* tar: --one-top-level with absolute path fails [rhel-9] (JIRA:Rocky Linux-144021)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-01T06:05:33.619213Z","modified":"2026-09-01T06:30:02.785483335Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:61586","title":"Moderate: tar security, bug fix, and enhancement update","description":"The GNU tar program can save multiple files in an archive and restore files from an archive.\n\nSecurity Fix(es):\n\n* tar: tar: Hidden file injection via crafted archives (CVE-2026-5704)\n\n* tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape (CVE-2026-18477)\n\n* tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite (CVE-2026-18508)\n\nBug Fix(es) and Enhancement(s):\n\n* tar: --one-top-level with absolute path fails (JIRA:Rocky Linux-143906)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-11T00:11:04.412973Z","modified":"2026-09-11T00:30:02.71912775Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:70390","title":"Moderate: tar security, bug fix, and enhancement update","description":"The GNU tar program can save multiple files in an archive and restore files from an archive.\n\nSecurity Fix(es):\n\n* tar: Tar path traversal (CVE-2025-45582)\n\n* tar: tar: Hidden file injection via crafted archives (CVE-2026-5704)\n\n* tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape (CVE-2026-18477)\n\n* tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite (CVE-2026-18508)\n\nBug Fix(es) and Enhancement(s):\n\n* tar: --one-top-level with absolute path fails [rhel-8.10.z] (JIRA:Rocky Linux-144019)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-24T06:01:09.673764Z","modified":"2026-09-24T06:30:02.6746523Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-5704","title":"CVE-2026-5704 in tar - Patched by Root","description":"Root has patched CVE-2026-5704 in the tar package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-08-25T14:09:26Z","modified":"2026-08-26T01:14:09.13697695Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:32.570806Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-5704","title":"CVE-2026-5704 in tar - Patched by Root","description":"Root has patched CVE-2026-5704 in the tar package for Root:Debian:13. Multiple fixed versions available.","status":"published","published":"2026-08-24T16:38:16Z","modified":"2026-08-24T18:45:11.805937394Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:33.681527Z"},{"id":"ROOT-OS-UBUNTU-2204-CVE-2026-5704","title":"CVE-2026-5704 in rootio-tar - Patched by Root","description":"Root has patched CVE-2026-5704 in the rootio-tar package for Root:Ubuntu:22.04. Multiple fixed versions available.","status":"withdrawn","published":"2026-06-03T07:49:23Z","modified":"2026-10-09T13:00:19.088719924Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:35.800481Z"},{"id":"ROOT-OS-UBUNTU-2404-CVE-2026-5704","title":"CVE-2026-5704 in rootio-tar - Patched by Root","description":"Root has patched CVE-2026-5704 in the rootio-tar package for Root:Ubuntu:24.04. Multiple fixed versions available.","status":"withdrawn","published":"2026-07-27T11:04:26Z","modified":"2026-10-09T13:00:19.144159711Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:39.492624Z"},{"id":"UBUNTU-CVE-2026-5704","description":"A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.","status":"published","published":"2026-04-06T16:16:00Z","modified":"2026-07-22T20:59:36.824197493Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"ALSA-2026:61581","title":"Moderate: tar security, bug fix, and enhancement update","description":"The GNU tar program can save multiple files in an archive and restore files from an archive.  \n\nSecurity Fix(es):  \n\n  * tar: tar: Hidden file injection via crafted archives (CVE-2026-5704)\n  * tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape (CVE-2026-18477)\n  * tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite (CVE-2026-18508)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * tar: --one-top-level with absolute path fails [almalinux-9] (JIRA:AlmaLinux-144021)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-31T00:00:00Z","modified":"2026-10-29T11:32:08.045056998Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:61586","title":"Moderate: tar security, bug fix, and enhancement update","description":"The GNU tar program can save multiple files in an archive and restore files from an archive.  \n\nSecurity Fix(es):  \n\n  * tar: tar: Hidden file injection via crafted archives (CVE-2026-5704)\n  * tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape (CVE-2026-18477)\n  * tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite (CVE-2026-18508)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * tar: --one-top-level with absolute path fails (JIRA:AlmaLinux-143906)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-31T00:00:00Z","modified":"2026-10-29T11:30:49.11135287Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:70390","title":"Moderate: tar security, bug fix, and enhancement update","description":"The GNU tar program can save multiple files in an archive and restore files from an archive.  \n\nSecurity Fix(es):  \n\n  * tar: Tar path traversal (CVE-2025-45582)\n  * tar: tar: Hidden file injection via crafted archives (CVE-2026-5704)\n  * tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape (CVE-2026-18477)\n  * tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite (CVE-2026-18508)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * tar: --one-top-level with absolute path fails [almalinux-8.10.z] (JIRA:AlmaLinux-144019)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-22T00:00:00Z","modified":"2026-10-29T11:02:29.621934812Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"AZL-98237","title":"CVE-2026-5704 affecting package tar 1.35-2","description":"A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.","status":"published","published":"2026-04-06T16:16:42Z","modified":"2026-10-22T05:35:55Z","updated_at":"2026-11-02T15:28:12.313414Z"},{"id":"CLSA-2026-1791450288","title":"tar: Fix of CVE-2026-5704","description":"- CVE-2026-5704: make listing and extraction skip archive members the same\n  way, so a crafted archive can no longer inject a file hidden from tar -t","status":"published","published":"2026-10-08T09:04:59Z","modified":"2026-10-26T09:31:36.708563329Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791452899","title":"tar: Fix of CVE-2026-5704","description":"- CVE-2026-5704: make listing and extraction skip archive members the same\n  way, so a crafted archive can no longer inject a file hidden from tar -t","status":"published","published":"2026-10-08T09:48:33Z","modified":"2026-10-26T09:30:53.614597381Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"MGASA-2026-0168","title":"Updated tar packages fix security vulnerability","description":"A flaw was found in tar. A remote attacker could exploit this\nvulnerability by crafting a malicious archive, leading to hidden file\ninjection with fully attacker-controlled content. This bypasses\npre-extraction inspection mechanisms, potentially allowing an attacker\nto introduce malicious files onto a system without detection.\nThis update fixes the reported issue.\n","status":"published","published":"2026-06-02T05:23:04Z","modified":"2026-06-02T05:30:05.304391775Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:11125-1","title":"tar-1.35-8.1 on GA media","description":"These are all security issues fixed in the tar-1.35-8.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-25T00:00:00Z","modified":"2026-06-26T08:15:05.701717571Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21070-1","title":"Security update for tar","description":"This update for tar fixes the following issues\n\n- CVE-2026-5704: crafted archives can be used to to hide file injection (bsc#1261900).\n- Fix --dereference/-h not working properly after CVE-2025-45582 fix (bsc#1265450).\n","status":"published","published":"2026-06-26T09:13:30Z","modified":"2026-06-30T18:24:39.271066833Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22289-1","title":"Security update for tar","description":"This update for tar fixes the following issues\n\n- CVE-2026-5704: crafted archives can be used to to hide file injection (bsc#1261900).\n- Fix --dereference/-h not working properly after CVE-2025-45582 fix (bsc#1265450).\n","status":"published","published":"2026-06-26T08:50:25Z","modified":"2026-06-30T18:24:27.493467242Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22377-1","title":"Security update for tar","description":"This update for tar fixes the following issues\n\n- CVE-2026-5704: crafted archives can be used to to hide file injection (bsc#1261900).\n- Fix --dereference/-h not working properly after CVE-2025-45582 fix (bsc#1265450).\n","status":"published","published":"2026-06-26T08:50:25Z","modified":"2026-07-02T18:24:15.040392181Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:2714-1","title":"Security update for tar","description":"This update for tar fixes the following issues\n\nSecurity fixes:\n\n- CVE-2026-5704: crafted archives can be used to to hide file injection (bsc#1261900).\n\nOther fixes:\n\n- Fix tar changing dir permissions temporarily even when using --no-overwrite-dir.\n- Fix --dereference/-h not working properly after CVE-2025-45582 fix (bsc#1265450).\n- Fix extraction failure for paths like 'a/./b' caused by the gnulib openat2\n implementation (bsc#1267189).\n","status":"published","published":"2026-06-30T12:05:19Z","modified":"2026-07-01T09:45:07.425327524Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"USN-8477-1","title":"tar vulnerability","description":"It was discovered that tar incorrectly handled certain crafted archive files.\nAn attacker could possibly use this to inject hidden files with\nattacker-controlled content, bypassing pre-extraction inspection mechanisms.","status":"published","published":"2026-06-25T20:57:32Z","modified":"2026-07-17T01:18:12.247681519Z","updated_at":"2026-11-02T16:58:25.103481Z"},{"id":"USN-8477-2","title":"tar regression","description":"USN-8477-1 fixed a vulnerability in tar. The update introduced a regression\nthat could cause tar to fail to extract certain valid files.\nThis update fixes the problem.\n\nOriginal advisory details:\n\n It was discovered that tar incorrectly handled certain crafted archive files.\n An attacker could possibly use this to inject hidden files with\n attacker-controlled content, bypassing pre-extraction inspection mechanisms.","status":"published","published":"2026-07-16T20:05:33Z","modified":"2026-07-17T05:19:51.333549617Z","updated_at":"2026-11-02T16:58:25.103481Z"},{"id":"USN-8477-3","title":"tar regression","description":"USN-8477-1 fixed a vulnerability in tar. That fix was incomplete and could\ncause tar to fail to extract old archives that recorded a nonzero size for\ndirectory entries, resulting in a regression.\nThis update fixes the problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n It was discovered that tar incorrectly handled certain crafted archive files.\n An attacker could possibly use this to inject hidden files with\n attacker-controlled content, bypassing pre-extraction inspection mechanisms.","status":"published","published":"2026-07-22T15:03:31Z","modified":"2026-07-22T20:59:36.420470147Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}