Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.6
GnuPG 2 allows archive extraction to overwrite files
published 2 days ago
Summary
The gpgtar tool in GnuPG version 2 up to 2.5.18 can be tricked into overwriting files outside the intended folder when extracting a crafted archive into a directory that already contains a symbolic link. This could let an attacker modify or replace files the user can write to. Use a newer GnuPG release (2.5.19 or later) or extract archives only into empty directories to avoid the risk.
What to do
- Update openeuler gnupg2 to version 2.4.3-17.oe2403sp3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| openEuler:24.03-LTS-SP3 | openeuler | gnupg2 |
< 2.4.3-17.oe2403sp3 Fix: upgrade to 2.4.3-17.oe2403sp3
|
Original advisory text
gnupg2 security update
GnuPG is a complete and free implementation of the OpenPGP standard as defined by RFC4880 (also known as PGP). GnuPG enables encryption and signing of data and communication, and features a versatile key management system as well as access modules for public key directories.
Security Fix(es):
gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.(CVE-2026-105712)
Security Fix(es):
gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.(CVE-2026-105712)
References
- https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-105712 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published16 Oct 2026
Updated16 Oct 2026
First seen16 Oct 2026
Sources
OESA-2026-4362 · OSV
Track software like this
Free during beta