Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.6
GnuPG 2 may overwrite files when extracting archives
published 2 days ago
Summary
The GnuPG tool (version before 2.5.19) can be tricked into writing over existing files if you extract an untrusted archive into a directory that already contains a shortcut (symlink). This happens because the extraction process follows the shortcut and places files outside the intended folder, limited only by the user’s file permissions. Update GnuPG to version 2.5.19 or later, or avoid using the "--directory" option on archives from unknown sources.
What to do
- Update openeuler gnupg2 to version 2.2.32-11.oe2203sp4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| openEuler:22.03-LTS-SP4 | openeuler | gnupg2 |
< 2.2.32-11.oe2203sp4 Fix: upgrade to 2.2.32-11.oe2203sp4
|
Original advisory text
gnupg2 security update
GnuPG is a complete and free implementation of the OpenPGP standard as defined by RFC4880 (also known as PGP). GnuPG enables encryption and signing of data and communication, and features a versatile key management system as well as access modules for public key directories.
Security Fix(es):
gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.(CVE-2026-105712)
Security Fix(es):
gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.(CVE-2026-105712)
References
- https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-105712 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published16 Oct 2026
Updated16 Oct 2026
First seen16 Oct 2026
Sources
OESA-2026-4360 · OSV
Track software like this
Free during beta