CVE-2026-18508: Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite
A flaw was found in GNU tar. The --one-top-level option is intended to confine extraction under a designated directory, but hardlink targets from the archive are not confined the same way and are resolved relative to the extraction working directory (or the directory given with -C). A crafted archive can create hardlinks inside the --one-top-level directory that point to files outside it. If a suitable symbolic link already exists under the extraction working directory, hardlinking to that symlink can bypass tar's usual symlink-based path protections and allow writing outside the intended top-level directory during a single extraction. Users who rely on --one-top-level as a security boundary when extracting untrusted archives may be affected.
Other sources
A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
When extracting untrusted archives, do not rely on GNU tar’s --one-top-level option as a security boundary; use a safer extraction approach that prevents hardlink/symlink escape (e.g., extract in a fully isolated sandbox/container with no sensitive writable paths).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18508?
The severity of CVE-2026-18508 is medium, rated at 4.4.
How do I fix CVE-2026-18508?
To fix CVE-2026-18508, update GNU tar to the latest patched version that addresses this vulnerability.
What are the risks associated with CVE-2026-18508?
CVE-2026-18508 allows arbitrary file overwrites due to improper handling of hardlink targets when using the --one-top-level option.
Who is affected by CVE-2026-18508?
Users of GNU tar who extract archives with the --one-top-level option may be affected by CVE-2026-18508.
What conditions lead to exploitation of CVE-2026-18508?
Exploitation of CVE-2026-18508 occurs when a crafted archive is used that takes advantage of the hardlink behavior when extracting.