Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Perl Archive::Tar can create files outside target folder
published 5 months ago
Summary
Versions of Perl’s Archive::Tar module before 3.08 may follow symbolic links that point outside the folder where an archive is being unpacked. An attacker who supplies a crafted archive could cause the program to read or write files elsewhere on the system. Upgrade the Perl package to the latest version or apply the vendor’s patch, and avoid extracting archives from untrusted sources.
What to do
- Update azure perl to version 5.38.2-512.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | perl |
< 5.38.2-512 Fix: upgrade to 5.38.2-512
|
Original advisory text
CVE-2026-42496 affecting package perl for versions less than 5.38.2-512
Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.
_make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target.
A subsequent open through the extracted name reads or writes the attacker chosen path.
_make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target.
A subsequent open through the extracted name reads or writes the attacker chosen path.
References
Timeline
Published26 May 2026
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-89133 · OSV
Track software like this
Free during beta