A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 5.5 · gnu, redhatNVD modified 2026-10-26 22:10
Affected (CPE criteria) 7
cpe:2.3:a:gnu:tar:-:*:*:*:*:*:*:*cpe:2.3:a:redhat:hardened_images:-:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
References 11
- https://access.redhat.com/errata/RHSA-2026:61581
- https://access.redhat.com/errata/RHSA-2026:61586
- https://access.redhat.com/errata/RHSA-2026:61783
- https://access.redhat.com/errata/RHSA-2026:66018
- https://access.redhat.com/errata/RHSA-2026:66514
- https://access.redhat.com/errata/RHSA-2026:70390
- https://access.redhat.com/security/cve/CVE-2026-5704 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2455360 Exploit, Issue Tracking, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/04/11/10 Exploit, Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/04/11/11 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/04/12/2 Exploit, Mailing List, Third Party Advisory