CVE-2026-18508

Summary

A flaw was found in GNU tar. When extracting an archive with the –one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.

Affected Software

VendorProductVersion RangeStatus
Red HatRed Hat Enterprise Linux 102:1.35-13.el10_2 < *unaffected
Red HatRed Hat Enterprise Linux 92:1.34-13.el9_8 < *unaffected
Red HatRed Hat Discovery 21788205779 < *unaffected
Red HatRed Hat Hardened Images1.35-9.2.hum1 < *unaffected
Red HatRed Hat Update Infrastructure 51788880445 < *unaffected
Red HatRed Hat Update Infrastructure 51788880464 < *unaffected
Red HatRed Hat Update Infrastructure 51788880456 < *unaffected
Red HatRed Hat Update Infrastructure 51788765051 < *unaffected
Red HatRed Hat Update Infrastructure 51788880581 < *unaffected

Weaknesses

  • CWE-59: Improper Link Resolution Before File Access ('Link Following')

Workarounds

Do not use –one-top-level as the sole confinement mechanism when extracting untrusted archives. Prefer extracting as an unprivileged user into a freshly created empty directory after changing into that directory (mkdir and cd), avoid extracting as root from sensitive working directories such as /, and follow the GNU tar security guidance for untrusted archives.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References