CVE-2026-105712

Katalog CVE

CVSS 3.6 · Low EPSS 0,12%

Kerentanan UNIX Symbolic Link (Symlink) Following. Skor CVSS 3.1 3.6 (Low) menurut mitre.org.

Deskripsi (NVD)

gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.

Rincian

Terbit di NVD

5 Oktober 2026

Terakhir diubah

6 Oktober 2026

Status NVD

Awaiting Analysis

CVSS 3.1

3.6 (Low), sumber mitre.org
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-61: UNIX Symbolic Link (Symlink) Following

EPSS (30 hari)

0,12% peluang dieksploitasi; lebih tinggi dari 1,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/gpg/gnupg/commit/7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88
• https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000504.html
• https://static.dev.gnupg.org/T8159.html