CVE-2026-42496

EUVD-2026-31774
Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.

_make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target.

A subsequent open through the extracted name reads or writes the attacker chosen path.
Link Following
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.1 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 35.6%
Affected Products (NVD)
VendorProductVersion
archive\\
𝑥
< 3.08
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
Red HatRed Hat Enterprise Linux 10
0:3.02-512.el10_2.1 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8
8100020260616084412.651ee29f ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8
0:2.30-2.el8_10 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9
0:2.38-6.el9_8.1 ≤
𝑥
< *
ADP
Debian logo
Debian Releases
Debian Product
Codename
perl
bookworm
postponed
bookworm (security)
vulnerable
bullseye
vulnerable
bullseye (security)
vulnerable
forky
vulnerable
sid
5.42.3-1
fixed
trixie
postponed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
perl
bionic
Fixed 5.26.1-6ubuntu0.7+esm2
released
focal
Fixed 5.30.0-9ubuntu0.5+esm2
released
jammy
Fixed 5.34.0-3ubuntu1.7
released
noble
Fixed 5.38.2-3.2ubuntu0.3
released
questing
Fixed 5.40.1-6ubuntu0.1
released
resolute
Fixed 5.40.1-7ubuntu0.1
released
trusty
Fixed 5.18.2-2ubuntu1.7+esm7
released
xenial
Fixed 5.22.1-9ubuntu0.9+esm2
released
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
perl-Archive-Tar
RHEL 9
0:2.38-6.el9_8.1
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
perl-Archive-Tar
Amazon Linux 2
0:1.92-3.amzn2.0.2
fixed
Amazon Linux 2023
0:3.04-522.amzn2023.0.3
fixed
perl-Archive-Tar-tests
Amazon Linux 2023
0:3.04-522.amzn2023.0.3
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
perl
Azure Linux 3.0
0:5.38.2-510.azl3
fixed