Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.6
GnuPG 2.5.19 gpgtar can overwrite files via crafted archive
published 2 days ago
Summary
The gpgtar tool that comes with GnuPG versions before 2.5.19 may follow a symbolic link inside an archive and write or replace files outside the folder you told it to extract to. This can happen when you extract an untrusted archive into a directory that already contains a link, potentially allowing unwanted changes to other parts of the system. Update GnuPG to version 2.5.19 or later, or avoid extracting untrusted archives into directories with existing links.
What to do
- Update openeuler gnupg2 to version 2.4.3-17.oe2403sp1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| openEuler:24.03-LTS-SP1 | openeuler | gnupg2 |
< 2.4.3-17.oe2403sp1 Fix: upgrade to 2.4.3-17.oe2403sp1
|
Original advisory text
gnupg2 security update
GnuPG is a complete and free implementation of the OpenPGP standard as defined by RFC4880 (also known as PGP). GnuPG enables encryption and signing of data and communication, and features a versatile key management system as well as access modules for public key directories.
Security Fix(es):
gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.(CVE-2026-105712)
Security Fix(es):
gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.(CVE-2026-105712)
References
- https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-105712 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published16 Oct 2026
Updated16 Oct 2026
First seen16 Oct 2026
Sources
OESA-2026-4361 · OSV
Track software like this
Free during beta