Skip to content
Fencer Intel
critical 9.1

CVE-2026-42496 json

Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory

published 5mo ago modified 3mo ago also EUVD-2026-31774

cvss
9.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 43%
public exploits
0
none known

Summary

Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.

_make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target.

A subsequent open through the extracted name reads or writes the attacker chosen path.

Patch / fix

  • BINGOS Archive::Tar 3.08
  • Red Hat Red Hat Enterprise Linux 10 0:3.02-512.el10_2.1
  • Red Hat Red Hat Enterprise Linux 8 0:2.30-2.el8_10, 8100020260616084412.651ee29f
  • Red Hat Red Hat Enterprise Linux 9 0:2.38-6.el9_8.1
  • perl Debian 12 5.36.0-7+deb12u4
  • perl Debian 13 5.40.1-6+deb13u1
  • perl Debian 14 5.42.3-1

debian advisories DEBIAN-CVE-2026-42496

  • perl Ubuntu 22.04 LTS 5.34.0-3ubuntu1.7
  • perl Ubuntu 24.04 LTS 5.38.2-3.2ubuntu0.3
  • perl Ubuntu 25.10 5.40.1-6ubuntu0.1
  • perl Ubuntu 26.04 LTS 5.40.1-7ubuntu0.1
  • perl Ubuntu Pro 14.04 LTS 5.18.2-2ubuntu1.7+esm7
  • perl Ubuntu Pro 18.04 LTS 5.26.1-6ubuntu0.7+esm2
  • perl Ubuntu Pro 20.04 LTS 5.30.0-9ubuntu0.5+esm2

ubuntu advisories UBUNTU-CVE-2026-42496

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • perl-Archive-Tar RHEL 10.2 3.02-512.el10_2.1
  • perl-Archive-Tar RHEL 9 2.38-6.el9_8.1
  • perl-Archive-Tar RHEL 8 2.30-2.el8_10
  • perl RHEL 8 4:5.32.1-474.module+el8.10.0+24099+8aa2f756
  • perl-B RHEL 8 1.80-474.module+el8.10.0+24099+8aa2f756
  • perl-if RHEL 8 0.60.800-474.module+el8.10.0+24099+8aa2f756
  • perl-IO RHEL 8 1.43-474.module+el8.10.0+24099+8aa2f756
  • perl-ph RHEL 8 5.32.1-474.module+el8.10.0+24099+8aa2f756

red hat advisories RHSA-2026:30857RHSA-2026:30856RHSA-2026:30852RHSA-2026:30851

  • perl AlmaLinux 8 4:5.32.1-474.module_el8.10.0+4162+0aac7c4c
  • perl-B AlmaLinux 8 1.80-474.module_el8.10.0+4162+0aac7c4c
  • perl-if AlmaLinux 8 0.60.800-474.module_el8.10.0+4162+0aac7c4c
  • perl-IO AlmaLinux 8 1.43-474.module_el8.10.0+4162+0aac7c4c
  • perl-ph AlmaLinux 8 5.32.1-474.module_el8.10.0+4162+0aac7c4c
  • perl-Env AlmaLinux 8 1.04-396.module_el8.6.0+2766+8bf0b7ce
  • perl-lib AlmaLinux 8 0.65-474.module_el8.10.0+4162+0aac7c4c
  • perl-mro AlmaLinux 8 1.23-474.module_el8.10.0+4162+0aac7c4c

almalinux advisories ALSA-2026:30851ALSA-2026:30852ALSA-2026:30856ALSA-2026:30857

  • perl-Archive-Tar Rocky Linux 8 2.30-2.el8_10
  • perl-Archive-Tar Rocky Linux 10 3.02-512.el10_2.1
  • perl-Archive-Tar Rocky Linux 9 2.38-6.el9_8.1
  • perl Rocky Linux 8 4:5.32.1-474.module+el8.10.0+40155+64ce2d41
  • perl-Env Rocky Linux 8 1.04-396.module+el8.10.0+1616+0d20cc68
  • perl-Env Rocky Linux 8 1.04-396.module+el8.10.0+40155+64ce2d41
  • perl-Env Rocky Linux 8 1.04-396.module+el8.6.0+878+f93dfff7
  • perl-Env Rocky Linux 8 1.04-396.module+el8.6.0+882+2fa1e48f

rocky linux advisories RLSA-2026:30852RLSA-2026:30857RLSA-2026:30856RLSA-2026:30851

  • perl Alpine 3.24 5.42.3-r0

alpine advisories ALPINE-CVE-2026-42496

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • perl Azure Linux 3.0 5.38.2-512

azure linux advisories AZL-89133

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2026-42496 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-42496 updated cvss 8.2

perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access

  • Red Hat Enterprise Linux 7 perl-Archive-Tar
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux AppStream (v. 8) perl 5.32.1-474.module+el8.10.0+24099+8aa2f756, perl-B 1.80-474.module+el8.10.0+24099+8aa2f756, perl-URI 1.76-5.module+el8.10.0+21354+3ad137bb, perl-CPAN 2.28-5.module+el8.10.0+21354+3ad137bb, perl-IO 1.43-474.module+el8.10.0+24099+8aa2f756, perl-Tie 4.6-474.module+el8.10.0+24099+8aa2f756, +213 more
    fixed: vendor fix RHSA-2026:30851
  • Red Hat Enterprise Linux AppStream (v. 9) perl-Archive-Tar 2.38-6.el9_8.1
    fixed: vendor fix RHSA-2026:30856
  • Red Hat Enterprise Linux AppStream (v. 10) perl-Archive-Tar 3.02-512.el10_2.1
    fixed: vendor fix RHSA-2026:30857
  • Red Hat Enterprise Linux BaseOS (v. 8) perl-Archive-Tar 2.30-2.el8_10
    fixed: vendor fix RHSA-2026:30852

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
5mo ago

Exploit prediction

0.50% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADP 3.1 8.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
NVD 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA 3.1 8.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Affected products

  • BINGOS Archive::Tar
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 7

Classification

Weakness
  • CWE-59 Improper Link Resolution Before File Access
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.