# CVE-2026-18508: Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite

Status: published. Published: 2026-08-03. Updated: 2026-11-02.

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.

## Remediation

- workaround: Do not use --one-top-level as the sole confinement mechanism when extracting untrusted archives. Prefer extracting as an unprivileged user into a freshly created empty directory after changing into that directory (mkdir and cd), avoid extracting as root from sensitive working directories such as /, and follow the GNU tar security guidance for untrusted archives. (source: CNA: redhat)

## Affected products and versions

- Red Hat / Red Hat Enterprise Linux 10 (tar): ≥ 2:1.35-13.el10_2; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8 (tar): ≥ 2:1.30-13.el8_10; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9 (tar): ≥ 2:1.34-13.el9_8; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Discovery 2 (discovery/discovery-server-rhel9): ≥ 1788205779; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Hardened Images (tar-main): ≥ 1.35-9.2.hum1; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Update Infrastructure 5 (rhui5/cds-kubernetes-rhel9): ≥ 1788880445; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Update Infrastructure 5 (rhui5/cds-rhel9): ≥ 1788880464; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Update Infrastructure 5 (rhui5/haproxy-rhel9): ≥ 1788880456; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Update Infrastructure 5 (rhui5/installer-rhel9): ≥ 1788765051; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Update Infrastructure 5 (rhui5/rhua-rhel9): ≥ 1788880581; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 6 (tar): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 7 (tar): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Hardened Images (aardvark-dns): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Hardened Images (chunkah): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Hardened Images (grafana12.4): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Hardened Images (grafana13.1): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Hardened Images (netavark): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Hardened Images (nodejs26): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Hardened Images (python-cryptography): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Hardened Images (rust): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Hardened Images (rust-rpm-sequoia): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Hardened Images (yarnpkg): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4 (openshift/ose-rhel-coreos-8): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4 (openshift/ose-rhel-coreos-9): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 5 (openshift/ose-rhel-coreos-9): Version range not reported. Source: CNA: redhat

## Severity and prioritization

- CVSS 3.1: 4.4 (medium); CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N; source: CNA: redhat

- CISA KEV: No listing in collected sources

- EPSS: 0.14% as of 2026-11-01; percentile 3.41%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-59

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://access.redhat.com/errata/RHSA-2026:50807 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:61581 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:61586 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:61783 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:66018 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:70390 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/security/cve/CVE-2026-18508 (CNA: redhat; vdb-entry, x_refsource_REDHAT)

- https://bugzilla.redhat.com/show_bug.cgi?id=2509843 (CNA: redhat; issue-tracking, x_refsource_REDHAT)

## Provenance

- CNA: redhat: https://www.cve.org/CVERecord?id=CVE-2026-18508; retrieved 2026-11-02; source updated 2026-11-02

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-18508; retrieved 2026-11-02; source updated Not reported

Revision: 70fea5640e222998b13838d91f44b2331c7ae035a5d7f6046f7251dcbdd0dd52

Canonical: https://y2.dev/cve/CVE-2026-18508