Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.6
GnuPG gpgtar can overwrite files when extracting archives
published 2 days ago
Summary
The gpgtar tool in GnuPG versions before 2.5.19 may follow existing symbolic links and overwrite files outside the intended extraction folder when a crafted archive is unpacked with the -C option. This could allow an attacker to modify or replace files the extracting user can write to. Update GnuPG to version 2.5.19 or newer, or extract archives only into empty directories to avoid the risk.
What to do
- Update openeuler gnupg2 to version 2.4.3-17.oe2403sp4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| openEuler:24.03-LTS-SP4 | openeuler | gnupg2 |
< 2.4.3-17.oe2403sp4 Fix: upgrade to 2.4.3-17.oe2403sp4
|
Original advisory text
gnupg2 security update
GnuPG is a complete and free implementation of the OpenPGP standard as defined by RFC4880 (also known as PGP). GnuPG enables encryption and signing of data and communication, and features a versatile key management system as well as access modules for public key directories.
Security Fix(es):
gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.(CVE-2026-105712)
Security Fix(es):
gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.(CVE-2026-105712)
References
- https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-105712 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published16 Oct 2026
Updated16 Oct 2026
First seen16 Oct 2026
Sources
OESA-2026-4363 · OSV
Track software like this
Free during beta