RHSA-2026:50807MediumCVSS 4.4

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
August 5, 2026
Last Modified
August 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-18508 →

📋 Description

CVE-2026-18508 — tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite

🎯 Affected products4

  • Red Hat Hardened Images
  • tar-main@aarch64 as a component of Red Hat Hardened Images
  • tar-main@src as a component of Red Hat Hardened Images
  • tar-main@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Do not use --one-top-level as the sole confinement mechanism when extracting untrusted archives. Prefer extracting as an unprivileged user into a freshly created empty directory after changing into that directory (mkdir and cd), avoid extracting as root from sensitive working directories such as /, and follow the GNU tar security guidance for untrusted archives.

🔗 References (5)