CVE-2026-5704: Tar: tar: hidden file injection via crafted archives
A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.
Other sources
Summary: GNU tar allows malformed archives where non-data-bearing typeflags (symlink, char device, block device, FIFO) contain a non-zero size field, leading to inconsistent behavior between listing (tar -t) and extraction (tar -x). This results in stream desynchronization and enables hidden file injection. Requirements to exploit: An attacker only needs the ability to supply a crafted tar archive to a target system that performs pre-extraction inspection using tar -t (or equivalent API) and later extracts it using GNU tar. No privileges or user interaction beyond extraction are required.
Patch Available: no
Version Fixed: N/A
Impact: Hidden file injection with fully attacker-controlled content
Bypass of pre-extraction inspection mechanisms
Single-implementation inconsistency (no cross-tool pipeline required)
Attack complexity: Low (crafted archive is < 3 KB, no special privileges)
Affected typeflags: '2', '3', '4', '6' (4 of 5 non-data typeflags)
Steps to reproduce if available:
Generate a crafted archive with a non-data-bearing typeflag (e.g., chardev) and non-zero size.
List contents
tar -tf crafted.tar
→ injected file is NOT shown
Extract archive:
tar -xf crafted.tar
Observe additional file created on disk that was not present in listing output.
— Red Hat