Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-06-09T17:04:44 dotnet: .NET: Local file tampering via link following vulnerability 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CWE-59

Improper link resolution before file access ('link following') in .NET allows an unauthorized attacker to perform tampering locally.

A flaw was found in .NET's System.Formats.Tar library. When extracting a specially crafted TAR archive containing symbolic links, the TarFile.ExtractToDirectory() method may incorrectly follow those links and write files outside the intended extraction directory. An attacker could exploit this issue to create or overwrite files in locations accessible to the extracting process, potentially leading to unauthorized file modification.

This vulnerability affects .NET's TAR archive extraction functionality. Red Hat Product Security has assessed this issue as a Moderate severity vulnerability. The flaw occurs in System.Formats.Tar when processing TAR archives containing symbolic links. During extraction, the TarFile.ExtractToDirectory() method may incorrectly follow symlink paths and write files outside the intended extraction directory. Successful exploitation requires a vulnerable application to process a specially crafted TAR archive. An attacker could use this behavior to create or overwrite files in locations accessible to the extracting process, potentially affecting system or application integrity. The vulnerability is a symlink path traversal issue that results in unauthorized file modification outside the designated extraction directory. The primary security impact is integrity compromise through arbitrary file writes. Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when they become available. Red Hat Enterprise Linux 10 2026-06-10T00:00:00Z RHSA-2026:25111 dotnet8.0-0:8.0.128-1.el10_2 Red Hat Enterprise Linux 10 2026-06-10T00:00:00Z RHSA-2026:25112 dotnet9.0-0:9.0.118-1.el10_2 Red Hat Enterprise Linux 10 2026-06-10T00:00:00Z RHSA-2026:25115 dotnet10.0-0:10.0.109-1.el10_2 Red Hat Enterprise Linux 10.0 Extended Update Support 2026-06-22T00:00:00Z RHSA-2026:28007 dotnet8.0-0:8.0.128-1.el10_0 Red Hat Enterprise Linux 10.0 Extended Update Support 2026-06-22T00:00:00Z RHSA-2026:28009 dotnet9.0-0:9.0.118-1.el10_0 Red Hat Enterprise Linux 8 2026-06-10T00:00:00Z RHSA-2026:25110 dotnet8.0-0:8.0.128-1.el8_10 Red Hat Enterprise Linux 8 2026-06-10T00:00:00Z RHSA-2026:25113 dotnet9.0-0:9.0.118-1.el8_10 Red Hat Enterprise Linux 8 2026-06-10T00:00:00Z RHSA-2026:25114 dotnet10.0-0:10.0.109-1.el8_10 Red Hat Enterprise Linux 9 2026-06-11T00:00:00Z RHSA-2026:25220 dotnet8.0-0:8.0.128-1.el9_8 Red Hat Enterprise Linux 9 2026-06-11T00:00:00Z RHSA-2026:25221 dotnet9.0-0:9.0.118-1.el9_8 Red Hat Enterprise Linux 9 2026-06-11T00:00:00Z RHSA-2026:25222 dotnet10.0-0:10.0.109-1.el9_8 Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 2026-06-23T00:00:00Z RHSA-2026:28227 dotnet8.0-0:8.0.128-1.el9_4 Red Hat Enterprise Linux 9.6 Extended Update Support 2026-06-22T00:00:00Z RHSA-2026:28011 dotnet8.0-0:8.0.128-1.el9_6 Red Hat Enterprise Linux 9.6 Extended Update Support 2026-06-29T00:00:00Z RHSA-2026:28051 dotnet9.0-0:9.0.118-1.el9_6 Red Hat Hardened Images 2026-05-14T00:00:00Z RHSA-2026:17527 dotnet9-0-main-9.0.117-1.hum1 Red Hat Hardened Images 2026-06-17T00:00:00Z RHSA-2026:26638 dotnet10-0-main-10.0.109-1.hum1 Red Hat Hardened Images 2026-06-18T00:00:00Z RHSA-2026:26994 dotnet8-0-main-8.0.128-1.hum1 https://www.cve.org/CVERecord?id=CVE-2026-45491 https://nvd.nist.gov/vuln/detail/CVE-2026-45491 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45491