CVE-2026-18508: GNU tar Path Traversal Vulnerability

CVE-2026-18508 Overview

CVE-2026-18508 is a hard link handling flaw in GNU tar [CWE-59]. When tar extracts an archive using the --one-top-level option, it fails to confine hardlink targets to the designated top-level directory. Hardlink targets can resolve relative to the extraction working directory instead. A crafted archive can create hardlinks that escape the intended boundary. When combined with a preexisting symbolic link under the working directory, the extraction can write files outside the intended boundary in a single pass.

Critical Impact
A crafted tar archive extracted with --one-top-level can write files outside the designated directory, bypassing the containment users expect from that option.

Affected Products

GNU tar (versions using the --one-top-level extraction option)
Red Hat Enterprise Linux distributions shipping affected tar builds
Downstream Linux distributions packaging vulnerable GNU tar releases

Discovery Timeline

2026-08-03 - CVE-2026-18508 published to the National Vulnerability Database
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-18508

Vulnerability Analysis

The flaw resides in how GNU tar processes hardlink entries during extraction with --one-top-level. This option is designed to enforce a single containment directory for all archive members. However, tar does not apply that containment to hardlink target paths. The link target resolves against the working directory instead of the top-level directory.

This category of issue falls under Link Following [CWE-59], a class that also covers symlink and hard link attacks. The vulnerability requires user interaction because the victim must extract the malicious archive. The scope is local, and impact is limited to file confidentiality and integrity within the extraction context.

The attack becomes practical when a symbolic link already exists under the working directory that points outside the intended boundary. The hardlink created from the archive can then chain through that symlink. A single extraction operation can therefore create or overwrite files at arbitrary paths reachable through the preexisting symlink.

Root Cause

GNU tar treats the --one-top-level boundary as applying only to regular file paths and does not enforce the same containment on hardlink targets. Hardlink target resolution remains relative to the extraction working directory, breaking the isolation guarantee the option implies.

Attack Vector

An attacker crafts a tar archive containing hardlink entries whose targets reference paths outside the top-level directory. The victim extracts the archive with tar --one-top-level. If a symbolic link under the working directory points outside the containment boundary, the hardlink resolution traverses that symlink and writes to an unintended location. Exploitation requires local access and user action, per the CVSS vector described in Red Hat's advisory.

No verified public exploit code is available. See the Red Hat CVE-2026-18508 advisory and Red Hat Bug Report #2509843 for upstream technical details.

Detection Methods for CVE-2026-18508

Indicators of Compromise

Unexpected files created outside the target directory following a tar --one-top-level extraction.
Presence of symbolic links inside extraction working directories that point to sensitive paths such as /etc, $HOME, or build output directories.
Archive entries where hardlink targets contain path components that resolve outside the archive's declared top-level directory.

Detection Strategies

Inspect archives before extraction using tar -tvf and flag entries whose link targets reference paths outside the archive root.
Audit CI/CD pipelines and automation that extract third-party tarballs with --one-top-level for reliance on its containment guarantee.
Monitor filesystem write events during archive extraction and alert when writes occur outside the invoking working directory tree.

Monitoring Recommendations

Log invocations of tar with --one-top-level across build servers, package systems, and user workstations.
Correlate tar process execution with file creation events outside the declared extraction directory using EDR telemetry.
Track upstream GNU tar and distribution package advisories for patched versions and backports.

How to Mitigate CVE-2026-18508

Immediate Actions Required

Apply vendor updates for GNU tar as soon as your distribution publishes patched packages.
Avoid extracting untrusted archives with --one-top-level until patched builds are deployed.
Extract untrusted archives inside a disposable directory that contains no preexisting symbolic links.

Patch Information

At publication time, GNU tar upstream and downstream distributions were coordinating fixes. Monitor the Red Hat CVE-2026-18508 advisory and Red Hat Bug Report #2509843 for patched package versions. Apply distribution updates through your standard package manager once available.

Workarounds

Extract untrusted archives inside empty, freshly created directories that contain no symbolic links.
Use tar -tvf archive.tar to enumerate entries and reject archives containing hardlinks whose targets escape the archive root.
Replace --one-top-level with extraction into an isolated container, chroot, or sandbox where writes outside the mount are impossible.
Run extraction as an unprivileged account with no write access to sensitive directories reachable through symlinks.

bash

# Safer extraction pattern for untrusted archives
mkdir -p /tmp/extract.$$ && cd /tmp/extract.$$
tar -tvf /path/to/untrusted.tar   # review contents first
tar -xf /path/to/untrusted.tar    # extract into an empty, symlink-free directory