RHSA-2026:61581MediumCVSS 5.0

Red Hat Security Advisory: tar security, bug fix, and enhancement update

Published
August 31, 2026
Last Modified
September 1, 2026

🔗 CVE IDs covered (3)

CVE-2026-18477 →CVE-2026-18508 →CVE-2026-5704 →

📋 Description

CVE-2026-5704 — tar: tar: Hidden file injection via crafted archives CVE-2026-18477 — tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape CVE-2026-18508 — tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite

🎯 Affected products14

  • Red Hat Enterprise Linux BaseOS (v. 9)
  • tar-2:1.34-13.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • tar-2:1.34-13.el9_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • tar-2:1.34-13.el9_8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • tar-2:1.34-13.el9_8.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • tar-2:1.34-13.el9_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • tar-debuginfo-2:1.34-13.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • tar-debuginfo-2:1.34-13.el9_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • tar-debuginfo-2:1.34-13.el9_8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • tar-debuginfo-2:1.34-13.el9_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • tar-debugsource-2:1.34-13.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • tar-debugsource-2:1.34-13.el9_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • tar-debugsource-2:1.34-13.el9_8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • tar-debugsource-2:1.34-13.el9_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, avoid extracting archives from untrusted sources. If processing untrusted archives is necessary, do so within a sandboxed environment to limit potential impact. Workaround: Do not perform incremental restores (-G/-g) from untrusted archives. Avoid restoring incremental backups on systems where untrusted users have shell access,​ perform restoration only on systems inaccessible to users. Workaround: Do not use --one-top-level as the sole confinement mechanism when extracting untrusted archives. Prefer extracting as an unprivileged user into a freshly created empty directory after changing into that directory (mkdir and cd), avoid extracting as root from sensitive working directories such as /, and follow the GNU tar security guidance for untrusted archives.

🔗 References (6)