https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T12:48:29.664278+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:61581 ALSA-2026:61581 — Moderate: tar security, bug fix, and enhancement update 2026-10-02T12:48:29.944284+00:00

Affected: AlmaLinux:9: tar

The GNU tar program can save multiple files in an archive and restore files from an archive.

Security Fix(es):

* tar: tar: Hidden file injection via crafted archives (CVE-2026-5704) * tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape (CVE-2026-18477) * tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite (CVE-2026-18508)

Bug Fix(es) and Enhancement(s):

* tar: --one-top-level with absolute path fails [almalinux-9] (JIRA:AlmaLinux-144021)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/euvd-2026-373903 EUVD-2026-373903 2026-10-02T12:48:29.944351+00:00 EUVD-2026-373903 https://cve.radiocsirt.org/vuln/fkie_cve-2026-18508 fkie_cve-2026-18508 2026-10-02T12:48:29.944369+00:00

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.

 https://cve.radiocsirt.org/vuln/ghsa-4f5j-wqjr-hx49 GHSA-4f5j-wqjr-hx49 2026-10-02T12:48:29.944394+00:00

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-18508 msrc_CVE-2026-18508 — Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite 2026-10-02T12:48:29.944411+00:00 msrc_CVE-2026-18508 https://cve.radiocsirt.org/vuln/oesa-2026-3911 OESA-2026-3911 — tar security update 2026-10-02T12:48:29.944430+00:00

Affected: openEuler:24.03-LTS-SP1: tar

GNU Tar provides the ability to create tar archives, as well as various other kinds of manipulation. For example, you can use Tar on previously created archives to extract files, to store additional files, or to update or list files which were already stored. Security Fix(es):

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.(CVE-2026-18508)

 https://cve.radiocsirt.org/vuln/rhsa-2026:50807 RHSA-2026:50807 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update 2026-10-02T12:48:29.944454+00:00

tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite

 https://cve.radiocsirt.org/vuln/rhsa-2026:61581 RHSA-2026:61581 — Red Hat Security Advisory: tar security, bug fix, and enhancement update 2026-10-02T12:48:29.944472+00:00

tar: tar: Hidden file injection via crafted archives tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite

 https://cve.radiocsirt.org/vuln/rlsa-2026:61581 RLSA-2026:61581 — Moderate: tar security, bug fix, and enhancement update 2026-10-02T12:48:29.944492+00:00

Affected: Rocky Linux:9: tar

The GNU tar program can save multiple files in an archive and restore files from an archive.

Security Fix(es):

* tar: tar: Hidden file injection via crafted archives (CVE-2026-5704)

* tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape (CVE-2026-18477)

* tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite (CVE-2026-18508)

Bug Fix(es) and Enhancement(s):

* tar: --one-top-level with absolute path fails [rhel-9] (JIRA:Rocky Linux-144021)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-18508 UBUNTU-CVE-2026-18508 2026-10-02T12:48:29.944518+00:00

Affected: Ubuntu:Pro:14.04:LTS: tar, Ubuntu:Pro:16.04:LTS: tar, Ubuntu:Pro:18.04:LTS: tar, Ubuntu:Pro:20.04:LTS: tar, Ubuntu:22.04:LTS: tar, Ubuntu:24.04:LTS: tar, Ubuntu:26.04:LTS: tar

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2633 WID-SEC-W-2026-2633 — GNU tar: Mehrere Schwachstellen ermöglichen Manipulation von Dateien 2026-10-02T12:48:29.944545+00:00

Ein Angreifer kann mehrere Schwachstellen in GNU tar ausnutzen, um Dateien zu manipulieren.