CVE-2007-4131

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-08-25 · updated 2026-06-16

Description

Directory traversal vulnerability in the contains_dot_dot function in src/names.c in GNU tar allows user-assisted remote attackers to overwrite arbitrary files via certain //.. (slash slash dot dot) sequences in directory symlinks in a TAR archive.

Affected products

GNU Tar: 1.13, 1.13.5, 1.13.11, 1.13.14, 1.13.16, 1.13.17 (+10)

References

http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=251921
http://docs.info.apple.com/article.html?artnum=307179
http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html
http://secunia.com/advisories/26573
http://secunia.com/advisories/26590
http://secunia.com/advisories/26603
http://secunia.com/advisories/26604
http://secunia.com/advisories/26655
http://secunia.com/advisories/26673
http://secunia.com/advisories/26674
http://secunia.com/advisories/26781
http://secunia.com/advisories/26822

Get alerted when CVE-2007-4131 or the next vulnerability affects your stack