https://seclists.org/oss-sec/2026/q2/104: GNU tar: listing/extraction desynchronization allows hidden file injection
Published Apr 11, 2026
·Updated
Affected Software
1 affected component
GNU GNU tar=1.35
Frequently Asked Questions
1
What is the severity of CVE-2026-11276?
The severity of CVE-2026-11276 is categorized as high due to potential exploitation leading to hidden file injection.
2
How do I fix CVE-2026-11276?
To fix CVE-2026-11276, users should upgrade to GNU tar version 1.36 or later, which addresses the vulnerability.
3
What are the implications of CVE-2026-11276?
CVE-2026-11276 allows an attacker to inject hidden files through listing and extraction discrepancies, potentially compromising data security.
4
Which versions of GNU tar are affected by CVE-2026-11276?
GNU tar versions up to and including 1.35 are affected by CVE-2026-11276.
5
Is there a workaround for CVE-2026-11276 before upgrading?
A temporary workaround for CVE-2026-11276 is to avoid using the listing and extraction commands concurrently.