CVE-2026-42496

CriticalCVSS 9.1/10Last modified Nov 10, 2026

Description

Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.

_make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target.

A subsequent open through the extracted name reads or writes the attacker chosen path.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-59 CWE-22

Affected software

Vendor	Product	Versions
BINGOS	Archive::Tar	< 3.08
Red Hat	Red Hat Enterprise Linux 10	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 9	—
Red Hat	Red Hat Enterprise Linux 7	—
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)	>= V3.1.7, < *
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)	>= V3.1.7, < *
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)	>= V3.1.7, < *
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)	>= V3.1.7, < *
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)	>= V3.1.7, < *

References

Timeline

Published: May 26, 2026
Last modified: Nov 10, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-424977.5Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory. _make_special_f CVE-2026-424987.3Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat. This issue affec CVE-2026-424997.5Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.CVE-2026-42502.5A vulnerability was found in Albert Sağlık Hizmetleri ve Ticaret Albert Health up to 1.7.3 on Android. Affected is an unknown function of th CVE-2026-425005.3Decoding a paletted BMP file with an out-of-range palette index results in a panic when accessing pixels in the invalid image.CVE-2026-425017.5A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation. This CVE-2026-425026.1Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attac CVE-2026-425038.8gopls by default communicates via pipe. However, -port and -listen flags are supported as means of debugging. If -listen is given a value wi CVE-2026-425047.5Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.CVE-2026-425055.3Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key iden CVE-2026-425066.1Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attac CVE-2026-425075.3When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to