Arbitrary file write in FileUtil#unpackEntries on Windows
Priority MEDIUM 49CWE-59Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 10 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes. As a result, a TAR entry may create a symlink under the expected extraction directory which points to an external directory. A subsequent TAR entry may extract an arbitrary file into the external directory using the symlink name. This however would be caught by the same targetDirPath check on Unix because of the getCanonicalPath call. However on Windows, getCanonicalPath doesn't resolve symbolic links, which bypasses the check. unpackEntries during TAR extraction follows symbolic links which allows writing outside expected base directory on Windows. This was addressed in Apache Hadoop 3.2.3
Why it matters now
EPSS 0.04241 91st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Apache Hadoop (Apache Software Foundation): 3.2.3, 3.4org.apache.hadoop:hadoop-common (Maven): 3.2.3, 2.10.2, 3.3.3Red Hat: 10 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Hadoop | before 3.2.3; 3.3.1; 3.3.2 | 3.2.3, 3.4 | Patch available | CNA |
| — | org.apache.hadoop:hadoop-common (Maven) | 3.2.0 to before 3.2.3 | 3.2.3 | Patch available | GHSA-gx2c-fvhc-ph4j |
| — | org.apache.hadoop:hadoop-common (Maven) | before 2.10.2 | 2.10.2 | Patch available | GHSA-gx2c-fvhc-ph4j |
| — | org.apache.hadoop:hadoop-common (Maven) | 3.3.0 to before 3.3.3 | 3.3.3 | Patch available | GHSA-gx2c-fvhc-ph4j |
- Apache Hadoop VendorApache Affected before 3.2.3; 3.3.1; 3.3.2 Fixed in 3.2.3, 3.4 Patch available CNA
- org.apache.hadoop:hadoop-common (Maven) Vendor— Affected 3.2.0 to before 3.2.3 Fixed in 3.2.3 Patch available GHSA-gx2c-fvhc-ph4j
- org.apache.hadoop:hadoop-common (Maven) Vendor— Affected before 2.10.2 Fixed in 2.10.2 Patch available GHSA-gx2c-fvhc-ph4j
- org.apache.hadoop:hadoop-common (Maven) Vendor— Affected 3.3.0 to before 3.3.3 Fixed in 3.3.3 Patch available GHSA-gx2c-fvhc-ph4j
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:* | before 3.2.3 | Vulnerable | Apache |
| cpe:2.3:a:apache:hadoop:3.3.1:-:*:*:*:*:*:* | 3.3.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:hadoop:3.3.2:-:*:*:*:*:*:* | 3.3.2 | Vulnerable | Apache |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:* Versions before 3.2.3 Vulnerable ·Apache
- cpe:2.3:a:apache:hadoop:3.3.1:-:*:*:*:*:*:* Versions 3.3.1 Vulnerable ·Apache
- cpe:2.3:a:apache:hadoop:3.3.2:-:*:*:*:*:*:* Versions 3.3.2 Vulnerable ·Apache
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
- Fix · CNA Apache Hadoop (Apache Software Foundation) Fixed in 3.2.3, 3.4
- Fix · GHSA-gx2c-fvhc-ph4j org.apache.hadoop:hadoop-common (Maven) Fixed in 3.2.3 Advisory →
- Fix · GHSA-gx2c-fvhc-ph4j org.apache.hadoop:hadoop-common (Maven) Fixed in 2.10.2 Advisory →
- Fix · GHSA-gx2c-fvhc-ph4j org.apache.hadoop:hadoop-common (Maven) Fixed in 3.3.3 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Logging Subsystem for Red Hat OpenShift | Affected | No fix yet |
| Red Hat Integration Camel K 1 | Affected | No fix planned: Will not fix |
| Red Hat Integration Camel Quarkus 1 | Affected | No fix planned: Will not fix |
| Red Hat Integration Data Virtualisation Operator | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Operations Network 3 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
Not affected: 8 products
- A-MQ Clients 2
- Red Hat AMQ Broker 7
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Data Grid 8
- Red Hat Fuse 7
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- streams for Apache Kafka
Timeline
- 2026-10-02 Threatist record created from CVE-2022-26612
- 2026-10-03 Alias added: GHSA-gx2c-fvhc-ph4j
References
Advisory 2
Other 7
- https://github.com/apache/hadoop
- https://github.com/apache/hadoop/commits/rel/release-2.10.2/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/FileUtil.java
- https://github.com/apache/hadoop/commits/rel/release-3.2.3/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/FileUtil.java
- https://github.com/apache/hadoop/commits/rel/release-3.3.3/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/FileUtil.java
- https://github.com/apache/hadoop/commits/rel/release-3.4.0/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/FileUtil.java
- https://issues.apache.org/jira/browse/HADOOP-18317
- https://security.netapp.com/advisory/ntap-20220519-0004
More Apache Hadoop vulnerabilities
- TI-2019-12818 Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while… CVSS 3.1CRITICAL 9.8
- TI-2022-08881 Command injection in org.apache.hadoop.fs.FileUtil.unTarUsingTar CVSS 3.1CRITICAL 9.8
- TI-2021-15353 Heap buffer overflow in libhdfs native library CVSS 3.1CRITICAL 9.8
- TI-2018-05786 Path traversal in Apache Hadoop CVSS 3.0HIGH 8.8
- TI-2017-11489 Information disclosure in Apache Hadoop CVSS 3.0CRITICAL 9.8
- TI-2016-02585 Information disclosure in Apache Hadoop CVSS 3.0CRITICAL 9.8
Sources
- CVE-2022-26612 · CVE Program
- CVE-2022-26612 · NVD
- FIRST EPSS
- GHSA-gx2c-fvhc-ph4j · GitHub Advisory Database · CC BY 4.0
- CVE-2022-26612 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences