Description
GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of "Member name contains '..'" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain "x -> ../../../../../home/victim/.ssh" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in which "tar xf" is run more than once (e.g., when installing a package can automatically install two dependencies that are set up as untrusted tarballs instead of official packages). NOTE: the official GNU Tar manual has an otherwise-empty directory for each "tar xf" in its Security Rules of Thumb; however, third-party advice leads users to run "tar xf" more than once into the same directory.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GNU | Tar | ≤ 1.35 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | tar | 1.35+dfsg-4ubuntu0.2 | USN-8510-1 |
| Ubuntu 25.10 | tar | No fix yet | — |
| Ubuntu 24.04 LTS | tar | 1.35+dfsg-3ubuntu0.2 | USN-8510-1 |
| Ubuntu 22.04 LTS | tar | 1.34+dfsg-1ubuntu0.1.22.04.4 | USN-8510-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | tar | No fix yet | — |
| Ubuntu Pro 18.04 LTS | tar | No fix yet | — |
| Ubuntu Pro 16.04 LTS | tar | No fix yet | — |
| Ubuntu Pro 14.04 LTS | tar | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | tar | 2:1.35-9.el10_1 | RHSA-2026:0002 |
| RHEL 9 | tar | 2:1.34-9.el9_7 | RHSA-2026:0067 |
| RHEL 8 | tar | 2:1.30-13.el8_10 | RHSA-2026:70390 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | tar | 2:1.35-7.el10_0.2 | RHSA-2026:0135 |
| RHEL 9.6 EUS | tar | 2:1.34-7.el9_6.2 | RHSA-2026:0435 |
| RHEL 9.4 EUS | tar | 2:1.34-6.el9_4.3 | RHSA-2026:0434 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | tar | 2:1.35-9.el10_1 | ALSA-2026:0002 |
| AlmaLinux 9 | tar | 2:1.34-9.el9_7 | ALSA-2026:0067 |
| AlmaLinux 8 | tar | 2:1.30-13.el8_10 | ALSA-2026:70390 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | tar | 2:1.35-9.el10_1 | RLSA-2026:0002 |
| Rocky Linux 9 | tar | 2:1.34-9.el9_7 | RLSA-2026:0067 |
| Rocky Linux 8 | tar | 2:1.30-13.el8_10 | RLSA-2026:70390 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | tar | 1.34-150000.3.37.1 | SUSE-SU-2026:1177-1 |
| SLES 15 SP6 | tar | 1.34-150000.3.37.1 | SUSE-SU-2026:1177-1 |
| SLES 15 SP5 | tar | 1.34-150000.3.37.1 | SUSE-SU-2026:1177-1 |
| SLES 15 SP4 | tar | 1.34-150000.3.37.1 | SUSE-SU-2026:1177-1 |
| SLES 12 SP5 | tar | 1.34-15.27.1 | SUSE-SU-2026:2615-1 |
Show 14 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | tar | 1.35-160000.3.1 | SUSE-SU-2026:22377-1, SUSE-SU-2026:21143-1 |
| SLES for SAP 15 SP6 | tar | 1.34-150000.3.37.1 | SUSE-SU-2026:1177-1 |
| SLES for SAP 15 SP5 | tar | 1.34-150000.3.37.1 | SUSE-SU-2026:1177-1 |
| SLES for SAP 15 SP4 | tar | 1.34-150000.3.37.1 | SUSE-SU-2026:1177-1 |
| SLES 16.0 | tar | 1.35-160000.3.1 | SUSE-SU-2026:22377-1, SUSE-SU-2026:21143-1 |
| SLE Micro 6.2 | tar | 1.35-160000.3.1 | SUSE-SU-2026:22289-1, SUSE-SU-2026:21002-1 |
| SLE Micro 6.1 | tar | 1.35-slfo.1.1_3.1 | SUSE-SU-2026:20955-1 |
| SLE Micro 6.0 | tar | 1.35-3.1 | SUSE-SU-2026:20959-1 |
| SLE Micro 5.5 | tar | 1.34-150000.3.37.1 | SUSE-SU-2026:1177-1 |
| SLE Micro 5.4 | tar | 1.34-150000.3.37.1 | SUSE-SU-2026:1177-1 |
| SLE Micro 5.3 | tar | 1.34-150000.3.37.1 | SUSE-SU-2026:1177-1 |
| SLE Micro 5.2 | tar | 1.34-150000.3.37.1 | SUSE-SU-2026:1177-1 |
| SLE HPC 15 SP5 | tar | 1.34-150000.3.37.1 | SUSE-SU-2026:1177-1 |
| SLE HPC 15 SP4 | tar | 1.34-150000.3.37.1 | SUSE-SU-2026:1177-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | tar | 1.35-7.1 | openSUSE-SU-2026:10743-1 |
| openSUSE Leap 16.0 | tar | 1.35-160000.3.1 | openSUSE-SU-2026:21070-1, openSUSE-SU-2026:20472-1 |
| openSUSE Leap 15.6 | tar | 1.34-150000.3.37.1 | SUSE-SU-2026:1177-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | tar | No fix yet | — |
| Azure Linux 2 (CBL-Mariner) | tar | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | tar | 2:1.35-9.el10_1 | ELSA-2026-0002 |
| Oracle Linux 9 | tar | 2:1.34-9.el9_7 | ELSA-2026-0067 |
| Oracle Linux 8 | tar | 2:1.30-13.el8_10 | ELSA-2026-70390 |
Advisories 30
- WID-SEC-2026-0008 Red Hat Enterprise Linux: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 3, 2026
- ALSA-2026:0002 Moderate: tar security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:0067 Moderate: tar security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:70390 Moderate: tar security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- RLSA-2026:70390 Moderate: tar security, bug fix, and enhancement update Rocky Linux Security Advisories · Sep 24, 2026
- RHSA-2026:70390 Red Hat Security Advisory: tar security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Sep 23, 2026
- RHSA-2026:0435 Red Hat Security Advisory: tar security update Red Hat Security Advisories (RHSA) · Sep 23, 2026
- RHSA-2026:0434 Red Hat Security Advisory: tar security update Red Hat Security Advisories (RHSA) · Sep 23, 2026
- RHSA-2026:0067 Red Hat Security Advisory: tar security update Red Hat Security Advisories (RHSA) · Sep 23, 2026
- RHSA-2026:0135 Red Hat Security Advisory: tar security update Red Hat Security Advisories (RHSA) · Sep 23, 2026
- RHSA-2026:0002 Red Hat Security Advisory: tar security update Red Hat Security Advisories (RHSA) · Sep 23, 2026
- ELSA-2026-70390 Moderate: tar security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Sep 23, 2026
- WID-SEC-2026-2253 IBM Security Verify Access: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 17, 2026
- WID-SEC-2026-1730 Xerox FreeFlow Print Server: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Jul 16, 2026
- USN-8510-1 tar vulnerability Ubuntu Security Notices (USN) · Jul 6, 2026
- SUSE-SU-2026:22377-1 Security update for tar SUSE / openSUSE Security Updates · Jul 2, 2026
- openSUSE-SU-2026:21070-1 Security update for tar SUSE / openSUSE Security Updates · Jun 30, 2026
- SUSE-SU-2026:22289-1 Security update for tar SUSE / openSUSE Security Updates · Jun 30, 2026
- SUSE-SU-2026:2615-1 Security update for tar SUSE / openSUSE Security Updates · Jun 25, 2026
- openSUSE-SU-2026:10743-1 tar-1.35-7.1 on GA media SUSE / openSUSE Security Updates · May 11, 2026
- SUSE-SU-2026:21143-1 Security update for tar SUSE / openSUSE Security Updates · Apr 22, 2026
- SUSE-SU-2026:21002-1 Security update for tar SUSE / openSUSE Security Updates · Apr 14, 2026
- openSUSE-SU-2026:20472-1 Security update for tar SUSE / openSUSE Security Updates · Apr 10, 2026
- SUSE-SU-2026:20959-1 Security update for tar SUSE / openSUSE Security Updates · Apr 8, 2026
- SUSE-SU-2026:20955-1 Security update for tar SUSE / openSUSE Security Updates · Apr 8, 2026
- SUSE-SU-2026:1177-1 Security update for tar SUSE / openSUSE Security Updates · Apr 3, 2026
- RLSA-2026:0067 Moderate: tar security update Rocky Linux Security Advisories · Jan 6, 2026
- RLSA-2026:0002 Moderate: tar security update Rocky Linux Security Advisories · Jan 5, 2026
- ELSA-2026-0002 Moderate: tar security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jan 5, 2026
- ELSA-2026-0067 Moderate: tar security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jan 5, 2026
References
- https://github.com/i900008/vulndb/blob/main/Gnu_tar_vuln.md
- https://www.gnu.org/software/tar/
- https://www.gnu.org/software/tar/manual/html_node/Security-rules-of-thumb.html
- https://www.gnu.org/software/tar/manual/html_node/Integrity.html
- https://lists.gnu.org/archive/html/bug-tar/2025-08/msg00012.html