CVE-2026-18508: Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite

Severity: medium (CVSS 4.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-03 · updated 2026-10-30
Weakness: CWE-59

Description

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.

Affected products

GNU Tar: 1.35 (and their updates)
Red Hat Enterprise Linux: 8.0, 9.0, 10.0 (and their updates)
Red Hat OpenShift Container Platform 4.18: 4.0 (and their updates)
Red Hat OpenShift Container Platform 4.18: all versions
Red Hat Discovery 2: all versions — fixed in 1788205779
Red Hat Enterprise Linux 10: all versions — fixed in 2:1.35-13.el10_2
Red Hat Enterprise Linux 8: all versions — fixed in 2:1.30-13.el8_10
Red Hat Enterprise Linux 9: all versions — fixed in 2:1.34-13.el9_8
Red Hat Hardened Images: all versions — fixed in 1.35-9.2.hum1
Red Hat OpenShift Container Platform 5: all versions
Red Hat Update Infrastructure 5: all versions — fixed in 1788880445

How to fix

Upgrade to a fixed version: Red Hat Discovery 2 1788205779; Red Hat Enterprise Linux 10 2:1.35-13.el10_2; Red Hat Enterprise Linux 8 2:1.30-13.el8_10; Red Hat Enterprise Linux 9 2:1.34-13.el9_8; Red Hat Hardened Images 1.35-9.2.hum1; Red Hat Update Infrastructure 5 1788880445. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-18508 or the next vulnerability affects your stack