CVE-2026-42497

CVE Enrichment

CVSS: 7.5 HIGH
EPSS: 0.47%
EPSS Percentile: 39.42%
CISA KEV: Not listed

Description

Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory. _make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode. A subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e
Published: 26-May-2026 09:16
Last Modified: 24-Jul-2026 18:10
EPSS Date: 2026-10-20
CWE: CWE-59, CWE-732

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:N /
                            I:H /
                            A:N

Affected Products / Versions

archive\:\:tar_project / archive\:\:tar Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 3.08
cpe:2.3:a:archive\:\:tar_project:archive\:\:tar:*:*:*:*:*:perl:*:*

References

Last enrichment sync: 01-Nov-2026 20:16
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

perl’s entry runs to 13 CVEs and includes symlink and hardlink extraction issues, CVE-2026-42496 and CVE-2026-42497, which matter to anything that unpacks an archive it did not create. Debian 13.7 Bundles 92 Security Advisories and Updates 106 Packages

CVE (19)

Products (18)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.