Gnu · Gnu Tar · CVE-2026-12565
**Name of the Vulnerable Software and Affected Versions**
The product name cannot be determined (affected versions not specified)
**Description**
The `unarchive` internal module's archive extraction commands lack code-level validation for extracted file paths. This causes the module to rely on the behavior of external tools, such as GNU tar, which varies across platforms. This path traversal issue allows a malicious archive to write files outside the intended extraction directory on systems using GNU tar versions prior to 1.34.
**Recommendations**
At the moment, there is no information about a newer version that contains a fix for this vulnerability.