CVE-2026-30039

CVE-2026-30039 CVE-2026-30039 のセキュリティアドバイザリ資料。rarfile におけるシンボリックリンクベースのアーカイブ展開問題で、バージョン 4.2 以前に影響します。 English advisory | 中文版本 概要 rarfile は、攻撃者が制御する RAR...

CVE-2024-0406-POC

CVE-2024-0406 Proof of Concept（PoC） このリポジトリには、CVE-2024-0406 の Proof of Concept（PoC）エクスプロイトが含まれています。これは、シンボリックリンクベースの tar アーカイブ展開に関連する脆弱性であり、影響を受けるシステム上でパストラバーサルやファイルの上書きを可能にします。 詳細は Path Traversal in mholt/archiver を参照してください。 脆弱性の詳細 CVE ID: CVE-2024-0406 説明: tar...

Rocky Linux 9.6 [TuxCare] Security Update: perl-Archive-Tar (ALMALINUX9.6:CLSA-2026:1783078783)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783078783 advisory. - Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory...

Directory Traversal

Overview @xhmikosr/decompress is an Extracting archives made easy Affected versions of this package are vulnerable to Directory Traversal via symlink extraction in index.js, where symlinks whose targets resolve outside the output directory are not validated before being written to disk. An attack...

Directory Traversal

Overview decompress is a package that can be used for extracting archives. Affected versions of this package are vulnerable to Directory Traversal via symlink extraction in index.js, where symlinks whose targets resolve outside the output directory are not validated before being written to disk. ...

EulerOS 2.0 SP10 : perl-Archive-Tar (EulerOS-SA-2026-3757)

According to the versions of the perl-Archive-Tar packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory...

EUVD-2026-78783

qbee transport is a remote access transport protocol implementation. Prior to 1.26.25, the extractTar routine uses strictly lexical path validation that does not account for on-disk symlinks created earlier in the extraction process. A crafted tar archive can use a symlink chain to write or...

PSF-2026-40

When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was...

EulerOS 2.0 SP12 : perl-Archive-Tar (EulerOS-SA-2026-3365)

According to the versions of the perl-Archive-Tar packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory...

EulerOS 2.0 SP12 : perl-Archive-Tar (EulerOS-SA-2026-3290)

According to the versions of the perl-Archive-Tar packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory...

NewStart CGSL MAIN 7.02 : perl-Archive-Tar Multiple Vulnerabilities (NS-SA-2026-0090)

The remote NewStart CGSL host, running version MAIN 7.02, has perl-Archive-Tar packages installed that are affected by multiple vulnerabilities: - Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. makespecialfile passes...

PT-2026-56970

Name of the Vulnerable Software and Affected Versions decompress versions prior to 4.2.2 Description An issue exists during archive extraction where the software allows arbitrary symlink creation. When processing symlink entries, the x.linkname field from the archive is passed directly to the...

Ansible galaxy-importer Path Traversal vulnerability

A path traversal vulnerability exists in Ansible when extracting tarballs. An attacker could craft a malicious tarball so that when using the galaxy importer of Ansible Automation Hub, a symlink could be dropped on the disk, resulting in files being overwritten...

USN-8467-2 perl vulnerabilities

USN-8467-1 fixed vulnerabilities in Perl. This update provides the corresponding fix for Perl on Ubuntu 25.10. Original advisory details: It was discovered that Perl's Archive::Tar module incorrectly handled symlink and hardlink targets during extraction. An attacker could use this issue to read ...

USN-8467-2: Perl vulnerabilities

USN-8467-1 fixed vulnerabilities in Perl. This update provides the corresponding fix for Perl on Ubuntu 25.10. Original advisory details: It was discovered that Perl's Archive::Tar module incorrectly handled symlink and hardlink targets during extraction. An attacker could use this issue to read ...

MGASA-2026-0230 Updated perl-Archive-Tar package fixes security vulnerabilities

The updated package fixes security vulnerabilities: Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. CVE-2026-42496 Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the...

Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory

...

AZL-89133 CVE-2026-42496 affecting package perl for versions less than 5.38.2-512

Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. makespecialfile passes the tar header's linkname to symlink without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular...

CVE-2026-44340

PraisonAI prior to 4.6.37 does not validate member.linkname or reject symlink/hardlink archive members in _safe_extractall, and calls tar.extractall(dest_dir) without a data filter. A bundle could contain a symlink inside dest_dir with a linkname outside it, followed by a file path traversing the...

CVE-2026-24884

The CVE-2026-24884 vulnerability affects the npm package compressing (versions ≤ 1.10.3 and 2.0.0) where TAR extraction of symbolic links is performed without validating link targets. This can allow an attacker to cause subsequent archive entries to be written to arbitrary locations on the host f...