CVE-2026-42496

Name of the Vulnerable Software and Affected Versions Archive::Tar versions prior to 3.08

Description Archive::Tar for Perl allows the extraction of symlinks with attacker-controlled targets located outside the extraction directory. The function make special file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. While a secure-extract mode exists to guard regular file extraction, it does not cover the symlink target. Consequently, a subsequent open operation through the extracted name can read or write to an attacker-chosen path.

Recommendations Update Archive::Tar to version 3.08 or later.