CVE-2026-42497 Details
Description
Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory. _make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode. A subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.
A vulnerability exists in Archive::Tar versions prior to 3.08 for Perl, where the extraction of hardlinks can lead to unauthorized file modifications. The issue arises because the '_make_special_file()' function transfers the linkname from the tar header to the 'link()' system call without proper validation against absolute paths or directory traversal segments. This flaw enables the creation of hardlinks that share the same inode as the original file. Consequently, any modifications made through the extracted link overwrite the original file. Additionally, during the extraction process, the tar header's file permissions, ownership, and timestamps are applied to the shared inode, further complicating the issue.
Users can upgrade to Archive::Tar version 3.08 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch | CPANSec | Patch |
| https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes | CPANSec | Release Notes |
| https://www.cve.org/CVERecord?id=CVE-2026-42496 | CPANSec | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | CPANSec |
| CWE-732 | Incorrect Permission Assignment for Critical Resource | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| archive::tar project archive::tar | < 3.08 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | Initial Analysis | [email protected] |
| May 26, 2026 | New CVE Received | CPANSec |