CVE-2026-42496

What it actually does

Archive::Tar for Perl versions before 3.08 can extract symbolic links whose targets are controlled by the archive author and point outside the intended extraction directory. The vulnerable code path passes the tar header link target directly to symlink() without rejecting absolute paths or parent-directory traversal sequences such as ../. As a result, an application that extracts an untrusted tar archive and later reads from or writes to the extracted symlink path may unintentionally access attacker-selected files elsewhere on the filesystem. Depending on how the consuming application handles extracted files, this can lead to unauthorized file disclosure or file overwrite outside the extraction root.

Why it matters to the business

Systems that accept or process tar archives from untrusted sources may expose sensitive files or allow modification of files outside the intended workspace. This is most concerning for package ingestion services, CI/CD pipelines, backup/restore tooling, file upload processors, and automation that extracts archives and then opens the extracted paths. Although public exploit maturity and EPSS are currently low and it is not listed in CISA KEV, the CVSS severity is high because successful exploitation can compromise confidentiality and integrity without authentication or user interaction when archive processing is exposed through a service.

How an attack unfolds

An attacker creates a tar archive containing a symbolic link entry whose visible filename appears to be inside the extraction directory, but whose link target is an absolute path or contains parent-directory traversal segments. A vulnerable application extracts the archive with Archive::Tar before version 3.08. Because the symlink target is not validated, the symlink is created even though it points outside the intended extraction directory. The attacker then relies on the application’s normal post-extraction behavior, such as scanning, reading, transforming, copying, or writing extracted files. When the application opens the symlink path, the filesystem follows the link and accesses the attacker-chosen external path. If the application reads it, sensitive local file contents may be exposed through logs, responses, artifacts, or downstream processing. If the application writes through it, files outside the extraction directory may be modified or overwritten with the application’s privileges.

How to fix it

Upgrade Archive::Tar to version 3.08 or later wherever it is installed or bundled. Review Perl dependency manifests, vendored modules, container images, CI runners, base images, and OS packages that may include Archive::Tar. If immediate upgrade is not possible, avoid extracting untrusted tar archives with vulnerable versions, reject archives containing symbolic links or hard links, and perform extraction inside a tightly isolated sandbox with minimal filesystem access. As a defense-in-depth measure, validate archive entries before extraction and reject link targets that are absolute paths, contain parent-directory traversal, or resolve outside the intended extraction directory. Run archive processing under a dedicated low-privilege account and ensure extraction directories are not reused across trust boundaries.

How to confirm the fix worked

Confirm that all runtime environments using Archive::Tar report version 3.08 or later. For Perl installations, check the installed module version with a command such as `perl -MArchive::Tar -e 'print $Archive::Tar::VERSION, "\n"'`. Validate application dependency lockfiles, container image package inventories, and deployment artifacts for older bundled copies. Perform a controlled test in a non-production environment using a tar archive containing a symlink with an absolute or ../ target and verify that extraction is rejected or that the symlink is not created. Also confirm that archive-processing code does not follow extracted symlinks when reading or writing files unless the resolved path is verified to remain inside the intended extraction root.

Typical attack path

1. Identify an application, build step, or service that processes attacker-supplied tar archives using vulnerable Archive::Tar versions before 3.08.
2. Create a tar archive containing a symbolic link entry with a target outside the extraction directory, such as an absolute path or a path containing ../ traversal.
3. Submit the archive through an upload, package ingestion, CI job, API, repository import, or other archive-processing workflow.
4. Allow the vulnerable extractor to create the unsafe symlink during extraction.
5. Trigger or wait for post-extraction logic that opens the symlink path for reading or writing.
6. Use the application’s output, generated artifacts, logs, or side effects to obtain sensitive file contents or cause unintended file modification.

How to detect it

There are no universal host or network indicators specific to this vulnerability because exploitation depends on application-specific archive handling and what files the application later opens. To investigate possible prior exploitation, review logs from file upload services, package ingestion systems, CI/CD jobs, repository importers, artifact processors, and backup/restore workflows for tar extraction of untrusted archives. Preserve and inspect submitted tar files where available, especially those processed by vulnerable Archive::Tar versions. Use `tar -tvf` or equivalent forensic tooling to identify symbolic link entries whose targets are absolute paths or contain parent-directory traversal. Look for post-extraction errors or access attempts involving sensitive paths outside the intended extraction directory, unexpected reads of system files, unexpected writes by archive-processing service accounts, and artifacts that contain contents from local files not included in the submitted archive. Correlate archive submission time with file access telemetry, EDR events, auditd logs, application logs, and generated output artifacts. Pay particular attention to symlink entries targeting configuration files, credentials, service keys, application source, SSH material, cloud metadata files, or other local secrets.

• tar archive contains symbolic link target beginning with /
• tar archive contains symbolic link target containing ../
• tar -tvf output contains -> /
• tar -tvf output contains -> ../
• Archive::Tar version < 3.08

What your security team should do

• Inventory all services, automation, build systems, and file-processing workflows that extract tar archives using Perl Archive::Tar.
• Prioritize remediation for internet-facing upload handlers, package ingestion systems, CI/CD runners, repository importers, and any workflow that processes archives from external or less-trusted sources.
• Upgrade Archive::Tar to 3.08 or later across hosts, containers, and vendored application dependencies.
• Temporarily block or quarantine tar archives containing symbolic links or hard links in workflows that cannot be patched immediately.
• Add pre-extraction validation that rejects absolute link targets and link targets containing parent-directory traversal.
• Run archive extraction in isolated, low-privilege sandboxes with restricted filesystem visibility.
• Search recent archive-processing logs and artifacts for evidence of symlink entries pointing outside extraction directories.
• Add regression tests using malicious symlink tar entries to ensure future extraction logic remains safe.