CVE-2026-18508

What it actually does

When extracting with --one-top-level, hardlink targets in a crafted archive are resolved relative to the current working directory instead of the designated top-level directory, allowing escape when a preexisting symlink is present under the working directory.

Why it matters to the business

Attackers can write files outside the intended extraction directory during a single archive extraction, potentially leading to unauthorized modification of system or application files on systems that process untrusted archives.

How an attack unfolds

An attacker creates a malicious archive containing hardlinks that point outside the extraction boundary. When a victim extracts it using the --one-top-level option in the presence of a preexisting symlink under the working directory, the hardlinks resolve outside the intended top-level directory and write to attacker-chosen locations.

How to fix it

Upgrade GNU tar to the fixed version 1.35-9.2.hum1 (RHSA-2026:50807) or later on Red Hat systems. Avoid extracting untrusted archives with --one-top-level until patched; consider using alternative extraction tools or sandboxed environments for untrusted content.

How to confirm the fix worked

Confirm the installed tar version is at least 1.35-9.2.hum1. Test extraction of a crafted archive containing hardlinks with --one-top-level and verify that files remain confined to the designated top-level directory.

Typical attack path

1. Place a preexisting symbolic link under the extraction working directory pointing to a target outside the intended boundary.
2. Craft an archive containing hardlinks whose targets resolve relative to the working directory rather than the top-level extraction directory.
3. Deliver the archive to the victim and induce extraction with the --one-top-level option.
4. Hardlinks are resolved during extraction, writing attacker-controlled content outside the designated directory.

How to detect it

Examine process execution logs and command history for invocations of tar with the --one-top-level flag against untrusted archives. Look for unexpected file creation or modification timestamps outside expected extraction directories following such operations.

What your security team should do

• Apply the vendor update to 1.35-9.2.hum1 immediately on all affected systems.
• Review and restrict use of --one-top-level when processing archives from untrusted sources.
• Monitor for new public exploit code or increased EPSS scores and reassess urgency if exploitation activity emerges.