[<prev] [next>] [day] [month] [year] [list]
Message-Id: <D67C8D47-06E4-4C31-9E99-850FBD9E71B1@stig.io>
Date: Tue, 26 May 2026 02:22:17 +0200
From: Stig Palmquist <stig@...g.io>
To: cve-announce@...urity.metacpan.org,
oss-security@...ts.openwall.com
Subject: CVE-2026-42496: Archive::Tar versions before 3.08 for Perl extract
symlinks with attacker controlled targets outside the extraction directory
========================================================================
CVE-2026-42496 CPAN Security Group
========================================================================
CVE ID: CVE-2026-42496
Distribution: Archive-Tar
Versions: before 3.08
MetaCPAN: https://metacpan.org/dist/Archive-Tar
VCS Repo: https://github.com/jib/archive-tar-new
Archive::Tar versions before 3.08 for Perl extract symlinks with
attacker controlled targets outside the extraction directory
Description
-----------
Archive::Tar versions before 3.08 for Perl extract symlinks with
attacker controlled targets outside the extraction directory.
_make_special_file() passes the tar header's linkname to symlink()
without validating it against absolute paths or .. segments. The
secure-extract mode check that guards regular file extraction does not
cover the symlink target.
A subsequent open through the extracted name reads or writes the
attacker chosen path.
Problem types
-------------
- CWE-59 Improper Link Resolution Before File Access ('Link Following')
Solutions
---------
Upgrade to Archive::Tar 3.08 or later.
References
----------
https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch
https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes
https://www.cve.org/CVERecord?id=CVE-2026-42497
Timeline
--------
- 2026-04-12: Issue reported.
- 2026-05-22: Version 3.08 released.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
