CVE-2026-105712 in GnuPG
Summary
by MITRE • 10/05/2026
gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/05/2026
The vulnerability identified in GnuPG versions prior to 2.5.19 represents a significant security flaw within the gpgtar component, specifically affecting the integrity of file system operations during archive extraction. This issue is classified under CWE-22, which denotes Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal or directory traversal. The core technical failure lies in how the software handles symbolic links when processing untrusted archives that are being extracted into an existing directory structure using the --directory flag. Under normal circumstances, extraction tools should confine file creation and modification strictly within the designated target directory to prevent interference with system files or user data located outside that scope. However, gpgtar fails to adequately validate whether a symlink present in the archive points to a location beyond the intended extraction boundary when combined with pre-existing symlinks on the host filesystem.
When an untrusted archive is extracted into a directory that already contains symbolic links, gpgtar exhibits behavior where it follows these existing local symlinks rather than treating them as isolated entities within the new context. If the crafted data in the archive includes entries designed to exploit this linkage, the extraction process can resolve paths through the pre-existing symlink and subsequently create or overwrite files at arbitrary locations on the filesystem. This bypasses the expected containment mechanism provided by the --directory option. The severity of this vulnerability is directly tied to the permissions of the user executing the extraction command. Since the write operations are limited by standard Unix file system permission models, a malicious actor can only affect resources accessible to that specific user account. Nevertheless, for users with elevated privileges or those operating in shared environments where sensitive data resides within reachable directories, this capability allows for unauthorized modification or destruction of critical files.
The operational impact of this vulnerability extends beyond simple file overwriting. By manipulating the extraction path through symlink following, an attacker could potentially overwrite configuration files, scripts, or other executables that are subsequently run by privileged processes or other users. This can lead to privilege escalation if a setuid binary is overwritten with malicious code, or it can result in denial of service conditions by corrupting essential system data. Furthermore, the risk is exacerbated when dealing with archives from untrusted sources, as attackers often craft archives specifically designed to trigger such path resolution errors during automated processing pipelines. It is important to note that this vulnerability does not affect extraction into fresh, empty directories where no pre-existing symlinks are present to be exploited by the archive contents. This distinction highlights that the flaw arises from an interaction between external state (the existing directory structure) and internal software logic rather than a fundamental failure in all extraction scenarios.
Mitigation strategies primarily involve upgrading GnuPG to version 2.5.19 or later, where this path traversal issue has been addressed through improved validation of symlink targets during the archive processing phase. In environments where immediate patching is not feasible, administrators should enforce strict policies regarding the handling of untrusted archives. This includes avoiding the use of the --directory flag with existing directories that may contain symlinks when extracting potentially malicious data. Instead, extraction should be performed into isolated, temporary, and empty directories to ensure no pre-existing symbolic links can influence path resolution. Additionally, implementing file integrity monitoring systems can help detect unauthorized modifications resulting from such exploitation attempts. Organizations must also review their internal workflows for processing GPG archives to ensure that automated scripts do not inadvertently expose this attack vector by reusing persistent directory structures without proper sanitization or isolation mechanisms. Adhering to these practices aligns with broader security standards emphasizing the principle of least privilege and strict input validation in file system operations.