CVE-2026-42496

CVE Enrichment

CVSS: 9.1 CRITICAL
EPSS: 0.43%
EPSS Percentile: 35.92%
CISA KEV: Not listed

Description

Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target. A subsequent open through the extracted name reads or writes the attacker chosen path.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e
Published: 26-May-2026 09:16
Last Modified: 24-Jul-2026 17:10
EPSS Date: 2026-10-20
CWE: CWE-59, CWE-22

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:N

Affected Products / Versions

archive\:\:tar_project / archive\:\:tar Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 3.08
cpe:2.3:a:archive\:\:tar_project:archive\:\:tar:*:*:*:*:*:perl:*:*

References

Last enrichment sync: 01-Nov-2026 20:13
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

perl’s entry runs to 13 CVEs and includes symlink and hardlink extraction issues, CVE-2026-42496 and CVE-2026-42497, which matter to anything that unpacks an archive it did not create. Debian 13.7 Bundles 92 Security Advisories and Updates 106 Packages

CVE (19)

Products (18)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.