CVE-2026-18508

Katalog CVE

CVSS 4.4 · Medium EPSS 0,14%

Kerentanan Improper Link Resolution Before File Access ('Link Following') pada gnu tar, redhat openshift container platform +1 lainnya. Skor CVSS 3.1 4.4 (Medium) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.

Rincian

Terbit di NVD

3 Agustus 2026

Terakhir diubah

22 September 2026

Status NVD

Modified

CVSS 3.1

4.4 (Medium), sumber redhat.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-59: Improper Link Resolution Before File Access ('Link Following')

EPSS (30 hari)

0,14% peluang dieksploitasi; lebih tinggi dari 3,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/errata/RHSA-2026:50807 advisory vendor
• https://access.redhat.com/security/cve/CVE-2026-18508 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2509843 issue tracking · advisory vendor
• https://access.redhat.com/errata/RHSA-2026:61581
• https://access.redhat.com/errata/RHSA-2026:61586
• https://access.redhat.com/errata/RHSA-2026:61783
• https://access.redhat.com/errata/RHSA-2026:66018
• https://access.redhat.com/errata/RHSA-2026:70390