CVE-2026-42497: Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory
Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.
makespecialfile() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.
A subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in extractfile() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Archive::Tarto a version that resolves this vulnerability.Fixed in 3.08
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42497?
CVE-2026-42497 is classified with a risk score of 30, indicating a significant vulnerability.
What is the impact of CVE-2026-42497?
CVE-2026-42497 allows attackers to create hardlinks to controlled paths outside the extraction directory, potentially compromising file security.
How do I fix CVE-2026-42497?
To fix CVE-2026-42497, upgrade to Archive::Tar version 3.08 or later.
Which versions are affected by CVE-2026-42497?
All versions of Archive::Tar for Perl before 3.08 are affected by CVE-2026-42497.
Who should be concerned about CVE-2026-42497?
Users and administrators of Perl applications that utilize the Archive::Tar module should be concerned about CVE-2026-42497.