CVE-2026-18508Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite

Description

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.

Timeline

Scores

EPSS (exploitation in 30 days)

0.14% · top 97% of all CVEs (13 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.4.

Affected products

• Red Hat · Red Hat Enterprise Linux 10

  • unaffected 2:1.35-13.el10_2 – < *

• Red Hat · Red Hat Enterprise Linux 8

  • unaffected 2:1.30-13.el8_10 – < *

• Red Hat · Red Hat Enterprise Linux 9

  • unaffected 2:1.34-13.el9_8 – < *

• Red Hat · Red Hat Discovery 2

  • unaffected 1788205779 – < *

• Red Hat · Red Hat Hardened Images

  • unaffected 1.35-9.2.hum1 – < *

• Red Hat · Red Hat Update Infrastructure 5

  • unaffected 1788880445 – < *

• Red Hat · Red Hat Update Infrastructure 5

  • unaffected 1788880464 – < *

• Red Hat · Red Hat Update Infrastructure 5

  • unaffected 1788880456 – < *

• Red Hat · Red Hat Update Infrastructure 5

  • unaffected 1788765051 – < *

• Red Hat · Red Hat Update Infrastructure 5

  • unaffected 1788880581 – < *

• Red Hat · Red Hat Enterprise Linux 6

  All versions: unknown

• Red Hat · Red Hat Enterprise Linux 7

  All versions: unknown

• Red Hat · Red Hat Hardened Images

  All versions: unaffected

• Red Hat · Red Hat Hardened Images

  All versions: unaffected

• Red Hat · Red Hat Hardened Images

  All versions: unaffected

• Red Hat · Red Hat Hardened Images

  All versions: unaffected

• Red Hat · Red Hat Hardened Images

  All versions: unaffected

• Red Hat · Red Hat Hardened Images

  All versions: unaffected

• Red Hat · Red Hat Hardened Images

  All versions: unaffected

• Red Hat · Red Hat Hardened Images

  All versions: unaffected

• Red Hat · Red Hat Hardened Images

  All versions: unaffected

• Red Hat · Red Hat Hardened Images

  All versions: unaffected

• Red Hat · Red Hat OpenShift Container Platform 4

  All versions: affected

• Red Hat · Red Hat OpenShift Container Platform 4

  All versions: affected

• Red Hat · Red Hat OpenShift Container Platform 5

  All versions: affected

What to do

Workaround: Do not use --one-top-level as the sole confinement mechanism when extracting untrusted archives. Prefer extracting as an unprivileged user into a freshly created empty directory after changing into that directory (mkdir and cd), avoid extracting as root from sensitive working directories such as /, and follow the GNU tar security guidance for untrusted archives.

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2026-52327 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-18508](https://cveledger.app/badge/CVE-2026-18508.svg)](https://cveledger.app/cve/CVE-2026-18508)

Record last updated 5 Nov 2026, 19:25 UTC.