[<prev] [next>] [day] [month] [year] [list]
Message-Id: <A0927582-6F48-48F2-987A-1DCE47177038@stig.io>
Date: Tue, 26 May 2026 02:25:17 +0200
From: Stig Palmquist <stig@...g.io>
To: cve-announce@...urity.metacpan.org,
oss-security@...ts.openwall.com
Subject: CVE-2026-42497: Archive::Tar versions before 3.08 for Perl extract
hardlinks to attacker controlled paths outside the extraction directory
========================================================================
CVE-2026-42497 CPAN Security Group
========================================================================
CVE ID: CVE-2026-42497
Distribution: Archive-Tar
Versions: before 3.08
MetaCPAN: https://metacpan.org/dist/Archive-Tar
VCS Repo: https://github.com/jib/archive-tar-new
Archive::Tar versions before 3.08 for Perl extract hardlinks to
attacker controlled paths outside the extraction directory
Description
-----------
Archive::Tar versions before 3.08 for Perl extract hardlinks to
attacker controlled paths outside the extraction directory.
_make_special_file() passes the tar header's linkname to link() without
validating it against absolute paths or .. segments, creating a
hardlink that shares the victim file's inode.
A subsequent write through the extracted name modifies the victim file,
and the post-extraction chmod, chown, and utime block in
_extract_file() (guarded only against symlinks via -l) applies the tar
header's mode, owner, and timestamps to the shared inode during
extraction alone.
Problem types
-------------
- CWE-59 Improper Link Resolution Before File Access ('Link Following')
- CWE-732 Incorrect Permission Assignment for Critical Resource
Solutions
---------
Upgrade to Archive::Tar 3.08 or later.
References
----------
https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch
https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes
https://www.cve.org/CVERecord?id=CVE-2026-42496
Timeline
--------
- 2026-04-12: Issue reported.
- 2026-05-10: Version 3.06 released, disabling hardlink extraction by
default.
- 2026-05-22: Version 3.08 released.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
