CVE-2015-8860

What it actually does

The vulnerability permits a malicious tar archive containing symlinks to cause extraction to write files outside the intended destination directory, resulting in arbitrary file writes on the filesystem.

Why it matters to the business

Attackers can tamper with or overwrite critical system and application files, leading to data corruption, service disruption, or unauthorized persistence in affected environments.

How an attack unfolds

An attacker creates a specially crafted tar archive embedding symlinks pointing outside the target directory, then supplies the archive to any process using the vulnerable tar package for extraction; the package follows the symlinks and writes attacker-controlled content to arbitrary locations.

How to fix it

Upgrade affected Chainguard mysql-8.0 packages to version 8.0.38-r0 or later; replace any older tar package dependency with a version 2.0.0 or newer.

How to confirm the fix worked

Verify package versions match or exceed the fixed releases; test extraction of a benign symlink-containing archive to confirm writes remain confined to the destination directory.

Typical attack path

1. Craft malicious tar archive containing symlinks and payload files
2. Deliver archive to a service or script that invokes the vulnerable tar extraction
3. Trigger extraction of the archive
4. Arbitrary files are overwritten via symlink traversal

How to detect it

Review application and container logs for unexpected file writes or permission changes during archive extraction; inspect process execution for tar invocations handling untrusted archives; monitor for creation of files outside expected directories.

What your security team should do

• Immediately update all listed mysql-8.0 Chainguard images to 8.0.38-r0
• Scan container images and build pipelines for any remaining vulnerable tar package versions
• Implement least-privilege extraction directories and archive validation in application code