Y2Y2
Open Cyber
Public vulnerability disclosure

CVE-2026-18508

Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite

publishedCWE-59

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.

Investigate in Cyber JSONMarkdown
Technical severity4.4 mediumCVSS 3.1 · CNA: redhat
Published2026-08-03Source updated 2026-11-02
Collected2026-11-022 attributed sources

Fixes and workarounds

Workaround

Do not use --one-top-level as the sole confinement mechanism when extracting untrusted archives. Prefer extracting as an unprivileged user into a freshly created empty directory after changing into that directory (mkdir and cd), avoid extracting as root from sensitive working directories such as /, and follow the GNU tar security guidance for untrusted archives.

Source: CNA: redhat

Affected products and versions

ProductVersionsAuthority
Red Hat Enterprise Linux 10
Red Hat
tar
https://access.redhat.com/downloads/content/package-browser/ 		≥ 2:1.35-13.el10_2; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 8
Red Hat
tar
https://access.redhat.com/downloads/content/package-browser/ 		≥ 2:1.30-13.el8_10; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 9
Red Hat
tar
https://access.redhat.com/downloads/content/package-browser/ 		≥ 2:1.34-13.el9_8; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Discovery 2
Red Hat
discovery/discovery-server-rhel9
https://catalog.redhat.com/software/containers/ 		≥ 1788205779; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Hardened Images
Red Hat
tar-main
https://catalog.redhat.com/software/containers/ 		≥ 1.35-9.2.hum1; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Update Infrastructure 5
Red Hat
rhui5/cds-kubernetes-rhel9
https://catalog.redhat.com/software/containers/ 		≥ 1788880445; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Update Infrastructure 5
Red Hat
rhui5/cds-rhel9
https://catalog.redhat.com/software/containers/ 		≥ 1788880464; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Update Infrastructure 5
Red Hat
rhui5/haproxy-rhel9
https://catalog.redhat.com/software/containers/ 		≥ 1788880456; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Update Infrastructure 5
Red Hat
rhui5/installer-rhel9
https://catalog.redhat.com/software/containers/ 		≥ 1788765051; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Update Infrastructure 5
Red Hat
rhui5/rhua-rhel9
https://catalog.redhat.com/software/containers/ 		≥ 1788880581; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 6
Red Hat
tar
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: unknown 		CNA: redhat
Red Hat Enterprise Linux 7
Red Hat
tar
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: unknown 		CNA: redhat
Red Hat Hardened Images
Red Hat
aardvark-dns
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: unaffected 		CNA: redhat
Red Hat Hardened Images
Red Hat
chunkah
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: unaffected 		CNA: redhat
Red Hat Hardened Images
Red Hat
grafana12.4
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: unaffected 		CNA: redhat
Red Hat Hardened Images
Red Hat
grafana13.1
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: unaffected 		CNA: redhat
Red Hat Hardened Images
Red Hat
netavark
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: unaffected 		CNA: redhat
Red Hat Hardened Images
Red Hat
nodejs26
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: unaffected 		CNA: redhat
Red Hat Hardened Images
Red Hat
python-cryptography
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: unaffected 		CNA: redhat
Red Hat Hardened Images
Red Hat
rust
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: unaffected 		CNA: redhat
Red Hat Hardened Images
Red Hat
rust-rpm-sequoia
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: unaffected 		CNA: redhat
Red Hat Hardened Images
Red Hat
yarnpkg
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: unaffected 		CNA: redhat
Red Hat OpenShift Container Platform 4
Red Hat
openshift/ose-rhel-coreos-8
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: affected 		CNA: redhat
Red Hat OpenShift Container Platform 4
Red Hat
openshift/ose-rhel-coreos-9
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: affected 		CNA: redhat
Red Hat OpenShift Container Platform 5
Red Hat
openshift/ose-rhel-coreos-9
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: affected 		CNA: redhat

Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.

CVSS assessments

Version / scoreVectorAuthority
3.1 / 4.4
medium		 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:NCNA: redhat

Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

References