CVE-2026-42496 Overview
CVE-2026-42496 is a symlink path traversal vulnerability in the Perl Archive::Tar module before version 3.08. The flaw resides in the _make_special_file() function, which passes the tar header's linkname directly to symlink() without validating absolute paths or .. segments. The secure-extract mode that guards regular file extraction does not cover symlink targets. An attacker who controls a tar archive can create symlinks pointing outside the extraction directory, and a subsequent open() on the extracted name reads or writes the attacker-chosen path [CWE-59].
Critical Impact
Attackers can read or overwrite arbitrary files on the host filesystem when a victim extracts a malicious tar archive using Archive::Tar before version 3.08.
Affected Products
- Archive::Tar Perl module versions prior to 3.08
- Perl applications and CPAN tooling that depend on Archive::Tar for archive extraction
- Downstream Linux distributions and containers shipping vulnerable Archive::Tar releases
Discovery Timeline
- 2026-05-26 - CVE-2026-42496 published to the National Vulnerability Database (NVD)
- 2026-05-28 - Last updated in NVD database
Technical Details for CVE-2026-42496
Vulnerability Analysis
The vulnerability is an insecure link resolution flaw in the extraction logic of Archive::Tar. When the module processes a tar entry representing a symbolic link, the _make_special_file() routine invokes Perl's symlink() builtin using the linkname field from the tar header. The module does not sanitize the link target. Attackers can supply absolute paths such as /etc/passwd or relative paths containing .. segments that escape the extraction root.
The module includes a secure-extract mode intended to prevent path traversal during archive expansion. That guard only applies to regular file entries. Symlink creation bypasses the check entirely. Once a malicious symlink exists inside the extraction directory, any later open() call on that name through Archive::Tar or the calling application reads or writes the attacker-controlled destination.
Root Cause
The root cause is missing validation of the linkname field before passing it to symlink(). The fix in commit 17c873492a05eddc0de18c1485e0b2cccd5a9158 extends the secure-extract logic to cover special file entries and rejects link targets that resolve outside the extraction directory.
Attack Vector
An attacker crafts a tar archive containing a symlink entry whose target is an absolute path or traverses upward with ... The archive also includes a regular file entry whose name matches the symlink. When the victim extracts the archive, Archive::Tar creates the symlink, then opens the matching name for writing. The write operation follows the symlink and overwrites the attacker-chosen target. A read-oriented variant exfiltrates file contents back through the extracted entry.
The vulnerability mechanism is documented in the GitHub commit patch and the MetaCPAN Changes list.
Detection Methods for CVE-2026-42496
Indicators of Compromise
- Unexpected symbolic links inside extraction directories pointing to absolute paths such as /etc/, /root/, or /var/
- Tar archive entries with linkname values containing .. segments or leading /
- Modifications to sensitive system files immediately following a Perl-based archive extraction process
Detection Strategies
- Inspect tar archives prior to extraction with tar -tvf and flag any entries whose link targets escape the archive root
- Audit installed CPAN modules and identify hosts running Archive::Tar versions below 3.08
- Correlate process execution of perl invoking Archive::Tar with subsequent file writes to paths outside the working directory
Monitoring Recommendations
- Enable filesystem auditing on sensitive paths such as /etc, ~/.ssh, and cron directories to capture writes following archive extraction
- Log symlink() and symlinkat() syscalls in build pipelines and CI runners that handle untrusted archives
- Track package manager telemetry for upgrades of the perl-Archive-Tar package across the fleet
How to Mitigate CVE-2026-42496
Immediate Actions Required
- Upgrade Archive::Tar to version 3.08 or later on all systems where Perl extraction is performed
- Rebuild container images and CI runners that bundle the vulnerable module
- Treat all externally sourced tar archives as untrusted and validate entries before extraction
Patch Information
The fix is available in Archive::Tar 3.08, published on MetaCPAN by BINGOS. The upstream patch is commit 17c873492a05eddc0de18c1485e0b2cccd5a9158 in the archive-tar-new repository. Distribution maintainers should track the MetaCPAN release notes for downstream packaging updates.
Workarounds
- Extract untrusted archives inside an isolated chroot, container, or unprivileged user namespace to limit symlink escape impact
- Pre-scan archives and reject any entry whose linkname contains .. or begins with /
- Replace Archive::Tar calls with hardened alternatives that enforce link target validation until patching is complete
# Configuration example: upgrade the vulnerable module via cpanm
cpanm Archive::Tar@3.08
# Verify installed version
perl -MArchive::Tar -e 'print "$Archive::Tar::VERSION\n"'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
