CVE-2026-18508

MediumCVSS 4.4/10Last modified Nov 5, 2026

Description

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-59

Affected software

Vendor	Product	Versions
Red Hat	Red Hat Enterprise Linux 10	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 9	—
Red Hat	Red Hat Discovery 2	—
Red Hat	Red Hat Hardened Images	—
Red Hat	Red Hat Update Infrastructure 5	—
Red Hat	Red Hat Update Infrastructure 5	—
Red Hat	Red Hat Update Infrastructure 5	—
Red Hat	Red Hat Update Infrastructure 5	—
Red Hat	Red Hat Update Infrastructure 5	—
Red Hat	Red Hat Enterprise Linux 6	—
Red Hat	Red Hat Enterprise Linux 7	—
Red Hat	Red Hat Hardened Images	—
Red Hat	Red Hat Hardened Images	—
Red Hat	Red Hat Hardened Images	—
Red Hat	Red Hat Hardened Images	—
Red Hat	Red Hat Hardened Images	—
Red Hat	Red Hat Hardened Images	—
Red Hat	Red Hat Hardened Images	—
Red Hat	Red Hat Hardened Images	—
Red Hat	Red Hat Hardened Images	—
Red Hat	Red Hat Hardened Images	—
Red Hat	Red Hat OpenShift Container Platform 4	—
Red Hat	Red Hat OpenShift Container Platform 4	—
Red Hat	Red Hat OpenShift Container Platform 5	—

References

Timeline

Published: Aug 3, 2026
Last modified: Nov 5, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-185097.1IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to gain privilege escalation via the Navigator for i debugger. This CVE-2026-18516.4The iVysilani Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' shortcode attribute in all version CVE-2026-185107.2The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CVE-2026-185117.8IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to generate a stack-based buffer overflow in the Native IBM i JSSE p CVE-2026-185126.4The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CVE-2026-185137.2IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schem CVE-2026-185154.3IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to place files into the file system with Navigator for i when they CVE-2026-185169.6An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform store CVE-2026-185177.7IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 IBM Maximo Application Suite — Location Service for Esr CVE-2026-18526.1The Product Pricing Table by WooBeWoo plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including,CVE-2026-185254.9IBM Secure Proxy 6.1.0.0 through 6.2.1.2 could allow a remote authenticated attacker to cause a denial of service due to improper validation CVE-2026-185267.4HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting (XSS) vulnerability in the oEmbed confirmation renderin