CVE-2026-5704

Summary

A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.

Affected Software

VendorProductVersion RangeStatus
Red HatRed Hat Enterprise Linux 102:1.35-13.el10_2 < *unaffected
Red HatRed Hat Enterprise Linux 82:1.30-13.el8_10 < *unaffected
Red HatRed Hat Enterprise Linux 92:1.34-13.el9_8 < *unaffected
Red HatRed Hat Discovery 21788205779 < *unaffected
Red HatRed Hat Hardened Images1.35-10.hum1 < *unaffected
Red HatRed Hat Update Infrastructure 51788880445 < *unaffected
Red HatRed Hat Update Infrastructure 51788880464 < *unaffected
Red HatRed Hat Update Infrastructure 51788880456 < *unaffected
Red HatRed Hat Update Infrastructure 51788765051 < *unaffected
Red HatRed Hat Update Infrastructure 51788880581 < *unaffected

Weaknesses

  • CWE-434: Unrestricted Upload of File with Dangerous Type

Workarounds

To mitigate this issue, avoid extracting archives from untrusted sources. If processing untrusted archives is necessary, do so within a sandboxed environment to limit potential impact.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

CVE Program Container

Additional References

References