CVE-2026-18508: Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite
A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18508?
The severity of CVE-2026-18508 is medium, rated at 4.4.
How do I fix CVE-2026-18508?
To fix CVE-2026-18508, update GNU tar to the latest patched version that addresses this vulnerability.
What are the risks associated with CVE-2026-18508?
CVE-2026-18508 allows arbitrary file overwrites due to improper handling of hardlink targets when using the --one-top-level option.
Who is affected by CVE-2026-18508?
Users of GNU tar who extract archives with the --one-top-level option may be affected by CVE-2026-18508.
What conditions lead to exploitation of CVE-2026-18508?
Exploitation of CVE-2026-18508 occurs when a crafted archive is used that takes advantage of the hardlink behavior when extracting.