CVE-2026-18477

Medium · 4.4

CVSS

4.4

EPSS

0.1%

Published

Aug 3, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A problem in the common tar backup tool can let someone with access to a backed-up folder change or add files when those backups are restored, which might give them extra control over the computer.

Exploitation: Requires User Interaction
Attacker needs: Local User
Complexity: High
Impact: Data Tampering
Component: Application
Class: Race Condition
Remediation: Upgrade
Effort: Medium
Patch risk: Low

What it actually does

A TOCTOU race condition in GNU tar's incremental dumpdir 'X' rename handling during extraction permits a local attacker to redirect file creation, rename, or overwrite operations outside the intended target directory.

Why it matters to the business

Organizations relying on tar for backups face risk of unauthorized file modifications or privilege escalation on restore systems, potentially disrupting data integrity and requiring extensive post-restore validation and incident response.

How an attack unfolds

A local attacker with write access to a directory being backed up prepares conditions in that directory; when the archive is later restored on a system the attacker can also access, the race window allows the rename handling to affect paths outside the extraction root without any modification to the archive itself.

How to fix it

Upgrade GNU tar to the fixed version 1.35-9.1.hum1 (RHSA-2026:49361) on all affected Red Hat systems; re-validate backup and restore workflows after deployment.

How to confirm the fix worked

Confirm the installed tar binary reports version 1.35-9.1.hum1 or newer; perform controlled extractions of incremental archives into isolated directories and verify no files appear outside the target path.

Typical attack path

Obtain local write access to a directory included in an incremental backup
Create or manipulate files and directory structures to influence dumpdir rename handling
Allow or trigger the backup process to complete
On the restore system, time access to the extraction process to win the TOCTOU window
Observe or leverage files created, renamed, or overwritten outside the intended directory

How to detect it

Review system and application logs around tar extraction events for unexpected file creation or rename operations outside declared target directories; correlate with user activity on directories that were previously backed up.

What your security team should do

Apply the vendor update to 1.35-9.1.hum1 on all systems performing tar restores
Audit and restrict local write access to directories included in incremental backups
Add monitoring for unexpected file activity during scheduled restore operations
Document and test alternative extraction methods that avoid incremental dumpdir handling until patched

The record

A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue.

Affected packages

Ecosystem	Package	Introduced	Fixed