CVE-2026-18508 Red Hat CVE debrief

Who should care

Users of GNU tar, especially those who extract archives from untrusted sources, should be aware of this vulnerability and take steps to mitigate it. System administrators, security teams, and developers who work with GNU tar or use it in their projects should prioritize patching and implement compensating controls to prevent potential local attacks. Additionally, operators and platform administrators should review the vulnerability's impact on their environments and take necessary actions to protect against exploitation.

Technical summary

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction. This issue can lead to potential local attacks if GNU tar is used to extract archives from untrusted sources.

Defensive priority

Organizations using GNU tar should prioritize patching to prevent potential local attacks.

Recommended defensive actions

• Apply patches or updates provided by the vendor to address the vulnerability
• Restrict access to sensitive directories and monitor for suspicious activity
• Implement compensating controls such as SELinux or other mandatory access control systems
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record indicates a flaw in GNU tar where hardlink targets are not confined to the designated top-level directory when extracting an archive with the --one-top-level option. This could allow crafted archives to create hardlinks that escape the intended boundary. Users should verify affected systems, review vendor guidance, and monitor for suspicious activity related to archive extraction.

Official resources