CVE-2026-105712: GnuPG gpgtar Path Traversal Vulnerability

CVE-2026-105712 Overview

CVE-2026-105712 is a symlink-following vulnerability in gpgtar, the archive utility bundled with GnuPG before version 2.5.19. When a user extracts an untrusted archive with the --directory (or -C) option into a non-empty directory, gpgtar can traverse a pre-existing symlink and write files outside the chosen extraction path. The write is bounded by the extracting user's filesystem permissions. Fresh, empty extraction directories are not affected. The flaw is tracked under [CWE-61: UNIX Symbolic Link (Symlink) Following].

Critical Impact
An attacker-supplied archive can overwrite arbitrary files writable by the extracting user, enabling tampering with configuration, scripts, or data outside the intended extraction directory.

Affected Products

GnuPG gpgtar versions prior to 2.5.19
Systems invoking gpgtar --directory or -C into a pre-existing, non-empty directory
Workflows that extract untrusted or externally sourced GnuPG archives

Discovery Timeline

2026-10-05 - CVE-2026-105712 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105712

Vulnerability Analysis

The vulnerability is a symlink attack against gpgtar's extraction routine. When gpgtar extracts an archive into a directory specified by --directory (or -C), it does not validate whether entries inside the target directory are symbolic links before writing to them. If an attacker can place or influence a symlink inside the extraction target, archive entries that match the symlink name are followed, resulting in writes outside the chosen extraction path.

Exploitation requires local access, user interaction to run the extraction, and specific preconditions (a non-empty target directory containing a pre-existing symlink). The resulting write primitive is constrained by the extracting user's filesystem permissions, limiting but not eliminating impact.

Root Cause

gpgtar-extract.c did not verify that the output directory supplied to --directory was empty or that it was not itself a symlink. Because the extractor opened path entries through the normal filesystem API, any symbolic link encountered during extraction was transparently resolved, allowing files to be created or overwritten outside the intended root.

Attack Vector

The attacker crafts an archive whose member names match a symlink the victim already has inside the target extraction directory. The victim then runs an extraction such as gpgtar -C /path/to/dir -x -f attacker.tar. During extraction, gpgtar follows the symlink and writes archive content to the symlink's target, potentially replacing files anywhere the user can write.

text

# Patch excerpt from doc/tools.texi
# Source: https://github.com/gpg/gnupg/commit/7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88

 @item --directory @var{dir}
 @itemx -C @var{dir}
 @opindex directory
-Extract the files into the directory @var{dir}.  The default is to
-take the directory name from the input filename.  ...
+Extract the files into the directory @var{dir}.  It raises an error
+when @var{dir} is not empty, or @var{dir} is a symlink to other
+directory.  When this option is not given, the default is to take the
+directory name from the input filename.  ...

The fix adds explicit checks to reject non-empty targets and symlinked target directories. The corresponding source change in tools/gpgtar-extract.c includes dirent.h and fcntl.h so the extractor can enumerate and validate the target before writing. See the GnuPG patch commit for the full diff.

Detection Methods for CVE-2026-105712

Indicators of Compromise

Unexpected file writes or modifications outside the directory passed to gpgtar -C or --directory
Presence of symbolic links inside directories used as gpgtar extraction targets before extraction runs
Modified timestamps on sensitive user-writable files (for example dotfiles under $HOME) that correlate with recent gpgtar invocations

Detection Strategies

Audit process execution logs for gpgtar invocations that include -C or --directory against non-empty paths
Correlate gpgtar process events with filesystem write events outside the specified extraction directory using EDR telemetry
Inventory installed GnuPG versions across endpoints and flag any build earlier than 2.5.19

Monitoring Recommendations

Enable filesystem auditing (for example auditd path and syscall rules) on directories commonly used for archive extraction
Alert on symlink creation inside shared or user-writable extraction directories prior to gpgtar execution
Track package manager events that install or update GnuPG to confirm patched versions are deployed

How to Mitigate CVE-2026-105712

Immediate Actions Required

Upgrade GnuPG to version 2.5.19 or later on all systems that run gpgtar
Instruct users and automation to extract untrusted archives only into freshly created empty directories
Review existing scripts and CI jobs that call gpgtar -C or --directory and ensure the target is created immediately before extraction

Patch Information

The fix is committed upstream in GnuPG and shipped in release 2.5.19. The extractor now rejects non-empty target directories and refuses targets that are themselves symlinks. Reference material: GnuPG patch commit 7a2692f, GnuPG announcement, and GnuPG T8159 technical note.

Workarounds

Always extract archives into a newly created empty directory, for example mktemp -d followed by gpgtar -C "$dir" -x -f archive.tar
Verify the extraction target contains no symbolic links before invoking gpgtar
Run extraction as a low-privilege user that cannot write to sensitive files or directories

bash

# Safer extraction pattern for untrusted gpgtar archives
dir="$(mktemp -d)"
# Confirm the directory is empty and not a symlink
[ -L "$dir" ] && { echo "target is a symlink"; exit 1; }
[ -z "$(ls -A "$dir")" ] || { echo "target not empty"; exit 1; }
gpgtar -C "$dir" -x -f /path/to/untrusted-archive.tar