PT-2026-23608

🗓️ 05 Mar 2026 00:00:00Reported by Positive TechnologiesType

ptsecurity🔗 dbugs.ptsecurity.com👁 33 Views

Tar extraction can overwrite files outside the extraction directory via a drive link.

Reporter	Title	Published	Views	Family All 178
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in tar-7.5.7.tgz	28 Apr 202622:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in tar-7.5.9.tgz	9 Jun 202615:24	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Bob	2 Jun 202614:29	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in watsonx.data	19 Aug 202615:14	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple Operator package issues	10 Jun 202618:06	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in node-tar bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Content-Aware Storage	9 Jul 202622:52	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in node-tar affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	4 May 202614:26	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Voice Gateway	31 Mar 202615:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands are vulnerable to arbitrary code execution, loss of confidentiality and denial of service	6 May 202613:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses tar-7.5.7.tgz, tar-7.5.9.tgz which is vulnerable to CVE-2026-29786	5 May 202612:47	–	ibm

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-AD27625.json
osv	www.osv.dev/vulnerability/CVE-2026-27143
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-33916
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-32283
t	www.t.me/cveNotify/155184
osv	www.osv.dev/vulnerability/ghsa-8gc5-j5rx-235r
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-4923
osv	www.osv.dev/vulnerability/CVE-2026-1528
t	www.t.me/CVEtracker/46730
redos	www.redos.red-soft.ru/support/secure/uyazvimosti-red-os-8-0/uyazvimost-nodejs-tar-cve-2026-29786-8.0/

18 Aug 2026 00:00Current

6.3Medium risk

Vulners AI Score6.3

CVSS 3.17.1 - 8.6

CVSS 48.2

EPSS0.00439

SSVC

tar archive hardlink attack escape path outside root arbitrary overwrite drive relative path link trick extraction process security vulnerability