Red Hat Security Advisory

RHSA-2026:61586

tar security, bug fix, and enhancement update

Released 2026-09-01 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux BaseOS (v. 10) tar-2:1.35-13.el10_2

Fixes 3 records

TI-2026-05002 CVE-2026-5704 · GHSA-jqqw-37x4-9rwj

Tar: tar: hidden file injection via crafted archives

LOW 25

A flaw was found in tar.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00473 Published 2026-04-06 Partial fix · 2:1.35-13.el10_2, 2:1.30-13.el8_10 +8 CWE-434

TI-2026-15195 CVE-2026-18508 · GHSA-4f5j-wqjr-hx49

Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite

LOW 19

A flaw was found in GNU tar.

CVSS 3.1MEDIUM 4.4 Local No auth User interaction EPSS 0.00141 Published 2026-08-03 Partial fix · 2:1.35-13.el10_2, 2:1.30-13.el8_10 +8 CWE-59

TI-2026-15176 CVE-2026-18477 · GHSA-v7fx-gjvh-347c

Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape

LOW 19

A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the att…

CVSS 3.1MEDIUM 4.4 Local Low privileges User interaction EPSS 0.00104 Published 2026-08-03 Partial fix · 2:1.35-13.el10_2, 2:1.30-13.el8_10 +8 CWE-367