CVE-2026-42496
A flaw in the Perl Archive::Tar module (versions before 3.08) lets an attacker create a tar file that contains a symlink pointing to any path on the system. When the archive is extracted, the module blindly follows the symlink, allowing the attacker to read or write files outside the intended extraction directory.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Perl developers using the Archive::Tar module, specifically versions earlier than 3.08.
Real-world impact
An attacker could use a crafted tar archive to read sensitive files or overwrite critical system files on a machine that extracts the archive, without needing any user interaction or special privileges.
Why this severity
The CVSS score of 9.1 reflects that the vulnerability is exploitable over the network, requires no authentication or user interaction, and can compromise both confidentiality and integrity of data on the affected system.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- May 26, 2026 · May 26, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- github.com/jib/archive-tar-new/commit/…patch
- metacpan.org/release/BINGOS/Archive-Tar-…release notes
- cve.org/CVERecordthird party advisory
- access.redhat.com/errata/RHSA-2026:30851
- access.redhat.com/errata/RHSA-2026:30852
- access.redhat.com/errata/RHSA-2026:30856
- access.redhat.com/errata/RHSA-2026:30857
- access.redhat.com/security/cve/CVE-2026-42496
- bugzilla.redhat.com/show_bug.cgi
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2…