https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T12:58:15.540047+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:0002 ALSA-2026:0002 — Moderate: tar security update 2026-10-02T12:58:15.997889+00:00

Affected: AlmaLinux:10: tar

The GNU tar program can save multiple files in an archive and restore files from an archive.

Security Fix(es):

* tar: Tar path traversal (CVE-2025-45582)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2026-00339 bdu:2026-00339 2026-10-02T12:58:15.997951+00:00 bdu:2026-00339 https://cve.radiocsirt.org/vuln/bell-cve-2025-45582 BELL-CVE-2025-45582 2026-10-02T12:58:15.997968+00:00

Affected: Alpaquita:23: tar, Alpaquita:stream: tar

 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0756 certfr-2025-avi-0756 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer… 2026-10-02T12:58:15.997989+00:00 certfr-2025-avi-0756 https://cve.radiocsirt.org/vuln/cnvd-2025-17798 cnvd-2025-17798 2026-10-02T12:58:15.998004+00:00 cnvd-2025-17798 https://cve.radiocsirt.org/vuln/euvd-2026-257387 EUVD-2026-257387 2026-10-02T12:58:15.998015+00:00 EUVD-2026-257387 https://cve.radiocsirt.org/vuln/fkie_cve-2025-45582 fkie_cve-2025-45582 2026-10-02T12:58:15.998026+00:00

GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of "Member name contains '..'" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain "x -> ../../../../../home/victim/.ssh" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in which "tar xf" is run more than once (e.g., when installing a package can automatically install two dependencies that are set up as untrusted tarballs instead of official packages). NOTE: the official GNU Tar manual has an otherwise-empty directory for each "tar xf" in its Security Rules of Thumb; however, third-party advice leads users to run "tar xf" more than once into the same directory.

 https://cve.radiocsirt.org/vuln/ghsa-f93m-9mq4-2fjj GHSA-f93m-9mq4-2fjj 2026-10-02T12:58:15.998056+00:00

GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of "Member name contains '..'" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain "x -> ../../../../../home/victim/.ssh" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in which "tar xf" is run more than once (e.g., when installing a package can automatically install two dependencies that are set up as untrusted tarballs instead of official packages).

 https://cve.radiocsirt.org/vuln/msrc_cve-2025-45582 msrc_CVE-2025-45582 — GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step pro… 2026-10-02T12:58:15.998078+00:00 msrc_CVE-2025-45582 https://cve.radiocsirt.org/vuln/oesa-2026-1091 OESA-2026-1091 — tar security update 2026-10-02T12:58:15.998098+00:00

Affected: openEuler:22.03-LTS-SP4: tar

GNU Tar provides the ability to create tar archives, as well as various other kinds of manipulation. For example, you can use Tar on previously created archives to extract files, to store additional files, or to update or list files which were already stored. Security Fix(es):

GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of "Member name contains '..'" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain "x -> ../../../../../home/victim/.ssh" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in which "tar xf" is run more than once (e.g., when installing a package can automatically install two dependencies that are set up as untrusted tarballs instead of official…

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10743-1 openSUSE-SU-2026:10743-1 — tar-1.35-7.1 on GA media 2026-10-02T12:58:15.998135+00:00

tar-1.35-7.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:0135 RHSA-2026:0135 — Red Hat Security Advisory: tar security update 2026-10-02T12:58:15.998151+00:00

tar: Tar path traversal

 https://cve.radiocsirt.org/vuln/rlsa-2026:70390 RLSA-2026:70390 — Moderate: tar security, bug fix, and enhancement update 2026-10-02T12:58:15.998166+00:00

Affected: Rocky Linux:8: tar

The GNU tar program can save multiple files in an archive and restore files from an archive.

Security Fix(es):

* tar: Tar path traversal (CVE-2025-45582)

* tar: tar: Hidden file injection via crafted archives (CVE-2026-5704)

* tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape (CVE-2026-18477)

* tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite (CVE-2026-18508)

Bug Fix(es) and Enhancement(s):

* tar: --one-top-level with absolute path fails [rhel-8.10.z] (JIRA:Rocky Linux-144019)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/suse-su-2026:20955-1 SUSE-SU-2026:20955-1 — Security update for tar 2026-10-02T12:58:15.998194+00:00

Security update for tar

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-45582 UBUNTU-CVE-2025-45582 2026-10-02T12:58:15.998209+00:00

Affected: Ubuntu:Pro:14.04:LTS: tar, Ubuntu:Pro:16.04:LTS: tar, Ubuntu:Pro:18.04:LTS: tar, Ubuntu:Pro:20.04:LTS: tar, Ubuntu:22.04:LTS: tar, Ubuntu:24.04:LTS: tar, Ubuntu:25.10: tar, Ubuntu:26.04:LTS: tar

GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of "Member name contains '..'" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain "x -> ../../../../../home/victim/.ssh" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in which "tar xf" is run more than once (e.g., when installing a package can automatically install two dependencies that are set up as untrusted tarballs instead of official packages). NOTE: the official GNU Tar manual has an otherwise-empty directory for each "tar xf" in its Security Rules of Thumb; however, third-party advice leads users to run "tar xf" more than once into the same directory.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0008 WID-SEC-W-2026-0008 — Red Hat Enterprise Linux: Mehrere Schwachstellen 2026-10-02T12:58:15.998248+00:00

Ein Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux bezüglich der Komponenten "tar" und "Scrapy" ausnutzen, um Dateien zu manipulieren, und um einen Denial of Service Angriff durchzuführen.