CVE-2026-5704Tar: tar: hidden file injection via crafted archives

Description

A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.

Timeline

Scores

EPSS (exploitation in 30 days)

0.47% · top 59% of all CVEs (14 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.0.

Affected products

• Red Hat · Red Hat Enterprise Linux 10

  • unaffected 2:1.35-13.el10_2 – < *

• Red Hat · Red Hat Enterprise Linux 8

  • unaffected 2:1.30-13.el8_10 – < *

• Red Hat · Red Hat Enterprise Linux 9

  • unaffected 2:1.34-13.el9_8 – < *

• Red Hat · Red Hat Discovery 2

  • unaffected 1788205779 – < *

• Red Hat · Red Hat Hardened Images

  • unaffected 1.35-10.hum1 – < *

• Red Hat · Red Hat Update Infrastructure 5

  • unaffected 1788880445 – < *

• Red Hat · Red Hat Update Infrastructure 5

  • unaffected 1788880464 – < *

• Red Hat · Red Hat Update Infrastructure 5

  • unaffected 1788880456 – < *

• Red Hat · Red Hat Update Infrastructure 5

  • unaffected 1788765051 – < *

• Red Hat · Red Hat Update Infrastructure 5

  • unaffected 1788880581 – < *

• Red Hat · Red Hat Enterprise Linux 6

  All versions: affected

• Red Hat · Red Hat Enterprise Linux 7

  All versions: affected

What to do

Workaround: To mitigate this issue, avoid extracting archives from untrusted sources. If processing untrusted archives is necessary, do so within a sandboxed environment to limit potential impact.

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2026-19317 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-5704](https://cveledger.app/badge/CVE-2026-5704.svg)](https://cveledger.app/cve/CVE-2026-5704)

Record last updated 5 Nov 2026, 22:15 UTC.