CVE-2026-42496
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target. A subsequent open through the extracted name reads or writes the attacker chosen path.
Risk Assessment
An attacker can place symlinks pointing to sensitive files outside the target directory, potentially leading to overwriting or reading critical system files.
Recommendation
Upgrade Archive::Tar to version 3.08 or later, which includes a fix that validates the symlink target.
Other vulnerabilities in Archive::Tar
See all- CVE-2020-36193HighActively exploited
Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.
- CVE-2020-28949HighActively exploited
Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.
- CVE-2026-9538High
In the Archive::Tar library for Perl versions before 3.10, memory exhaustion is possible via an attacker-controlled entry size field in the tar header. The _read_tar() function allocates a scalar based on the header size without an upper bound.
- CVE-2026-42497High
A vulnerability in Archive::Tar for Perl before version 3.08 allows extraction of hardlinks to attacker-controlled paths outside the extraction directory. The _make_special_file() function passes the tar header's linkname to link() without validating absolute paths or '..' segments, creating a hardlink to the victim file. A subsequent write through the extracted name modifies the victim file, and the _extract_file() block (guarded only against symlinks) applies permissions, owner, and timestamps to the shared inode.
Original NVD description (English source)
Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target. A subsequent open through the extracted name reads or writes the attacker chosen path.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS