PT-2026-20374

🗓️ 18 Feb 2026 00:00:00Reported by Positive TechnologiesType

ptsecurity🔗 dbugs.ptsecurity.com👁 8 Views

tar.extract can create a hardlink outside the extraction root via symlinks, enabling arbitrary read/write.

Reporter	Title	Published	Views	Family All 978
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in tar-7.5.7.tgz	28 Apr 202622:25	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities addressed with IBM Business Automation Workflow cumulative fixes June 2026	29 Jun 202610:18	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Bob	2 Jun 202614:29	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple Operator package issues	10 Jun 202618:06	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in node-tar bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Content-Aware Storage	9 Jul 202622:52	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in node-tar affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	4 May 202614:26	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Voice Gateway	31 Mar 202615:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands are vulnerable to arbitrary code execution, loss of confidentiality and denial of service	6 May 202613:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Planning Analytics Local is affected by security vulnerabilities	9 Jul 202614:00	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses tar-7.5.7.tgz which is vulnerable to CVE-2026-26960	5 May 202609:38	–	ibm

Source	Link
redos	www.redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-nodejs-tar-cve-2026-26960-8.0
osv	www.osv.dev/vulnerability/CVE-2026-25547
github	www.github.com/isaacs/node-tar/security/advisories/GHSA-83g3-92jg-28cx
osv	www.osv.dev/vulnerability/CVE-2026-1527
osv	www.osv.dev/vulnerability/ghsa-f886-m6hf-6m8v
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-33810
osv	www.osv.dev/vulnerability/ghsa-37ch-88jc-xwx2
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-42338
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-1526
osv	www.osv.dev/vulnerability/CVE-2026-25896

24 Jun 2026 00:00Current

5.6Medium risk

Vulners AI Score5.6

CVSS 3.17.1 - 8.8

EPSS0.0034

SSVC