CVE-2026-18508

Name of the Vulnerable Software and Affected Versions GNU tar (affected versions not specified)

Description A flaw exists when extracting an archive using the --one-top-level option. Hardlink targets are not restricted to the designated top-level directory and may resolve relative to the extraction working directory. A specially crafted archive can create hardlinks that bypass the intended boundary. When combined with a preexisting symbolic link in the working directory, this may allow writing files outside the intended boundary during a single extraction process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.