CVE-2026-18508 in tar
Summary
by MITRE • 08/03/2026
A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/03/2026
This vulnerability in GNU tar represents a significant directory traversal flaw that exploits the --one-top-level extraction option to bypass intended security boundaries. The issue stems from improper handling of hardlink targets during archive extraction, where the software fails to properly constrain hardlink resolution within the designated top-level directory structure. When tar processes archives with this option, it creates a single top-level directory for all extracted content but does not adequately validate or restrict the paths of hardlink targets that may reference locations outside this boundary.
The technical implementation flaw occurs during the extraction process when tar encounters hardlink entries in the archive. Normally hardlinks should reference files within the same filesystem and directory structure, but in this case the software allows relative path resolution that can escape the intended extraction scope. The vulnerability specifically manifests when a crafted archive contains hardlink targets that use relative paths, enabling attackers to create hardlinks pointing outside the designated extraction directory. This behavior violates fundamental security principles of containment and isolation that should be maintained during archive extraction operations.
The operational impact of this vulnerability extends beyond simple file placement issues and can enable arbitrary file system modifications when combined with existing symbolic links in the working directory. An attacker who controls a crafted archive can potentially create hardlinks that point to pre-existing symbolic links elsewhere in the filesystem, allowing them to write files or modify content outside the intended extraction scope. This creates a path traversal scenario where the extraction operation itself becomes an attack vector for writing to unauthorized locations. The vulnerability is particularly dangerous because it combines multiple exploitation techniques into a single attack surface, making it more difficult to detect and prevent.
Security controls should focus on implementing strict path validation during hardlink processing, ensuring that all link targets are properly resolved within the designated extraction boundaries. The mitigation strategy involves strengthening input validation to prevent relative path resolution outside the intended directory scope, particularly for hardlink targets in archives processed with --one-top-level options. This vulnerability aligns with CWE-22 Path Traversal and CWE-367 Time-of-Check Time-of-Use issues, while also mapping to ATT&CK techniques involving privilege escalation through file system manipulation. Organizations should ensure that tar extraction operations are performed with restricted permissions and that proper sandboxing mechanisms are in place to contain potential exploitation attempts. The vulnerability highlights the importance of validating all archive metadata during extraction and implementing comprehensive path validation controls for symbolic and hardlink entries.