Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.4

GNU tar incremental backup can write files outside target directory

CVE-2026-18477 · published 3 months ago
Summary

The tar program used on several Linux platforms (including Red Hat Enterprise Linux and Debian) has a flaw that can cause files to be created or renamed outside the folder where a backup is being restored. An attacker who can write to the backup directory could cause unwanted changes to other parts of the system, potentially gaining higher privileges. Update the tar package to the latest version or use a different backup method that does not rely on the vulnerable incremental restore feature.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
Ubuntu:26.04:LTS canonical tar All versions
Debian:11 debian tar All versions
Debian:12 debian tar All versions
Debian:13 debian tar All versions
Debian:14 debian tar All versions
– red hat red hat enterprise linux 10 All versions
– red hat red hat enterprise linux 6 All versions
– red hat red hat enterprise linux 7 All versions
– red hat red hat enterprise linux 8 All versions
– red hat red hat enterprise linux 9 All versions
– red hat red hat hardened images All versions
– red hat red hat openshift container platform 4 All versions
Ubuntu:Pro:14.04:LTS canonical tar All versions
Ubuntu:Pro:16.04:LTS canonical tar All versions
Ubuntu:Pro:18.04:LTS canonical tar All versions
Ubuntu:Pro:20.04:LTS canonical tar All versions
Ubuntu:22.04:LTS canonical tar All versions
Ubuntu:24.04:LTS canonical tar All versions
– gnu tar 1.35
cpe:2.3:a:gnu:tar:1.35:*:*:*:*:*:*:*
– redhat openshift_container_platform 4.0
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
– redhat enterprise_linux 8.0
9.0
10.0
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
– red hat red hat discovery 2 All versions
– red hat red hat update infrastructure 5 All versions
– red hat red hat openshift container platform 5 All versions
Original advisory text
Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape
A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
4.4 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-367Time-of-check Time-of-use (TOCTOU) Race Condition
Timeline
Published3 Aug 2026
Updated31 Oct 2026
First seen3 Aug 2026
Sources
DEBIAN-CVE-2026-18477 · OSV
CVE-2026-18477 · NVD
CVE-2026-18477 · MITRE
UBUNTU-CVE-2026-18477 · OSV
Track software like this
Free during beta