Security Advisory

CVE-2026-42496

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-05-26 00:17:19

Last updated 2026-07-15 00:57:33

Assigner CPANSec

CVSS score not scored

State PUBLISHED

Description

Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target. A subsequent open through the extracted name reads or writes the attacker chosen path.

← Browse all CVEs View on cve.org ↗