CVE-2026-18477 Details

A TOCTOU (Time-of-Check Time-of-Use) vulnerability has been identified in GNU Tar's handling of incremental backups. This issue allows a local attacker with write access to a directory being backed up to disrupt the restoration process. If the attacker can access the system where the restoration is taking place, they may influence the extraction by creating, renaming, or overwriting files and directories outside the designated extraction area. Such actions could result in unauthorized modifications of files or, in certain situations, lead to privilege escalation. Notably, exploitation does not require the attacker to alter the backup archive itself, and conventional backup and restore procedures—such as extracting into a newly created directory without the -P option—do not address this vulnerability.

Users are advised to avoid restoring incremental backups on systems where untrusted users have shell access, especially if those users could have modified the backed-up data. When restoring backups that include user-controlled content, it is recommended to do so only on systems that are not accessible to those users.