Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-31T00:00:00 tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite 4.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N CWE-59

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.

Red Hat Enterprise Linux is affected. This issue only applies when the --one-top-level option is used to extract an untrusted archive. Default tar extraction without --one-top-level is not impacted by this specific boundary failure. Users should avoid using --one-top-level as the sole confinement mechanism for untrusted archives until fixed packages are available. This issue was discovered by Pavel Cahyna (Red Hat). Do not use --one-top-level as the sole confinement mechanism when extracting untrusted archives. Prefer extracting as an unprivileged user into a freshly created empty directory after changing into that directory (mkdir and cd), avoid extracting as root from sensitive working directories such as /, and follow the GNU tar security guidance for untrusted archives. Red Hat Enterprise Linux 10 2026-09-01T00:00:00Z RHSA-2026:61586 tar-2:1.35-13.el10_2 Red Hat Enterprise Linux 9 2026-08-31T00:00:00Z RHSA-2026:61581 tar-2:1.34-13.el9_8 Red Hat Discovery 2 2026-08-31T00:00:00Z RHSA-2026:61783 discovery/discovery-server-rhel9:1788205779 Red Hat Hardened Images 2026-08-05T00:00:00Z RHSA-2026:50807 tar-main-1.35-9.2.hum1 Red Hat Update Infrastructure 5 2026-09-09T00:00:00Z RHSA-2026:66018 rhui5/cds-kubernetes-rhel9:1788880445 Red Hat Update Infrastructure 5 2026-09-09T00:00:00Z RHSA-2026:66018 rhui5/cds-rhel9:1788880464 Red Hat Update Infrastructure 5 2026-09-09T00:00:00Z RHSA-2026:66018 rhui5/haproxy-rhel9:1788880456 Red Hat Update Infrastructure 5 2026-09-09T00:00:00Z RHSA-2026:66018 rhui5/installer-rhel9:1788765051 Red Hat Update Infrastructure 5 2026-09-09T00:00:00Z RHSA-2026:66018 rhui5/rhua-rhel9:1788880581 Red Hat Enterprise Linux 6 Out of support scope tar Red Hat Enterprise Linux 7 Out of support scope tar Red Hat Enterprise Linux 8 Fix deferred tar Red Hat Hardened Images Not affected aardvark-dns Red Hat Hardened Images Not affected chunkah Red Hat Hardened Images Not affected grafana12.4 Red Hat Hardened Images Not affected grafana13.1 Red Hat Hardened Images Not affected netavark Red Hat Hardened Images Not affected nodejs26 Red Hat Hardened Images Not affected python-cryptography Red Hat Hardened Images Not affected rust Red Hat Hardened Images Not affected rust-rpm-sequoia Red Hat Hardened Images Not affected yarnpkg Red Hat OpenShift Container Platform 4 Fix deferred openshift/ose-rhel-coreos-8 Red Hat OpenShift Container Platform 4 Fix deferred openshift/ose-rhel-coreos-9 https://www.cve.org/CVERecord?id=CVE-2026-18508 https://nvd.nist.gov/vuln/detail/CVE-2026-18508