CVE-2026-42497: Archive::Tar Privilege Escalation Flaw

CVE-2026-42497 Overview

CVE-2026-42497 is a hard link attack vulnerability [CWE-59] in the Archive::Tar Perl module before version 3.08. The flaw allows a crafted tar archive to create hardlinks pointing to attacker-controlled paths outside the extraction directory. During extraction, the module shares the victim file's inode with the extracted name, enabling integrity tampering of files the extracting process can write to.

The vulnerability resides in the _make_special_file() function, which passes the tar header's linkname directly to Perl's link() builtin without validating absolute paths or .. segments.

Critical Impact
A malicious tar archive can hardlink to sensitive files outside the extraction directory, then overwrite their contents and modify ownership, permissions, and timestamps through the post-extraction chmod, chown, and utime block in _extract_file().

Affected Products

Archive::Tar Perl module versions before 3.08
Perl distributions bundling vulnerable Archive::Tar (core module)
Applications and build pipelines that extract untrusted tar archives using Archive::Tar

Discovery Timeline

2026-05-26 - CVE-2026-42497 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-42497

Vulnerability Analysis

The vulnerability is a hard link attack in Archive::Tar's extraction routine. When the module encounters a tar entry of hardlink type, it invokes _make_special_file(), which passes $entry->linkname to Perl's link() without sanitization. An attacker can place an absolute path such as /etc/passwd or a relative path traversing parent directories into the linkname field of the tar header.

After the hardlink is created, the extracted name and the victim file share an inode. Any subsequent write to the extracted name modifies the victim file. The post-extraction block in _extract_file() then applies the tar header's mode, owner, and mtime to the shared inode. This block is guarded only against symlinks using the -l test, so it does not skip hardlinks.

The result is integrity loss on files outside the extraction directory, limited to files writable by the extracting process. There is no confidentiality or availability impact according to the CVSS vector.

Root Cause

The root cause is missing validation of the linkname field in tar headers for hardlink entries. The pre-patch code did not reject absolute paths or paths containing .. segments under SECURE EXTRACT MODE. The protection that existed for symlinks was not applied to hardlinks.

Attack Vector

Exploitation requires the victim to extract an attacker-supplied tar archive using Archive::Tar. No authentication or user interaction beyond extraction is required. Network delivery via package mirrors, CI/CD pipelines, or web upload handlers makes this remotely reachable.

perl

     my $err;
 
     if( $entry->is_symlink ) {
+        if( !$INSECURE_EXTRACT_MODE ) {
+            my $linkname = $entry->linkname;
+            if( File::Spec->file_name_is_absolute($linkname) ) {
+                $self->_error( qq[Symlink '] . $entry->full_path .
+                    qq[' has absolute target. Not extracting under SECURE EXTRACT MODE] );
+                return;
+            }
+            if( grep { $_ eq '..' } File::Spec->splitdir($linkname) ) {
+                $self->_error( qq[Symlink '] . $entry->full_path .
+                    qq[' target attempts traversal. Not extracting under SECURE EXTRACT MODE] );
+                return;
+            }
+        }
         my $fail;
         if( ON_UNIX ) {
             symlink( $entry->linkname, $file ) or $fail++;

Source: GitHub commit 17c8734. The patch adds validation of linkname for symlinks and hardlinks under SECURE EXTRACT MODE, rejecting absolute paths and .. traversal segments.

Detection Methods for CVE-2026-42497

Indicators of Compromise

Tar archives containing hardlink entries (typeflag1) whose linkname field is an absolute path or contains .. segments.
Unexpected inode sharing between extracted files and sensitive system files such as /etc/passwd, /etc/shadow, SSH keys, or cron files.
Changes to mode, uid, gid, or mtime of files outside the extraction directory immediately following an Archive::Tar extraction process.

Detection Strategies

Inspect tar archives before extraction with tar -tvf and flag any hardlink entries with suspicious linkname targets.
Audit process telemetry for perl processes invoking link(2) system calls with paths that escape the working directory.
Track installed Archive::Tar versions across hosts and developer workstations and alert when versions below 3.08 are detected.

Monitoring Recommendations

Enable Linux audit rules on sensitive paths to record link, chmod, chown, and utimensat syscalls during archive extraction workflows.
Monitor CI/CD runners and build agents for unexpected modifications to files outside the project workspace after tar extraction steps.
Forward filesystem and process telemetry to a centralized analytics platform to correlate extraction events with downstream file integrity changes.

How to Mitigate CVE-2026-42497

Immediate Actions Required

Upgrade Archive::Tar to version 3.08 or later on all systems, including Perl-bundled installations.
Inventory build pipelines, package managers, and web applications that extract untrusted tar archives with Archive::Tar and prioritize their remediation.
Avoid running tar extraction as root or any privileged account that can write to sensitive system files.

Patch Information

The fix is delivered in Archive::Tar 3.08, available from CPAN. Refer to the MetaCPAN Module Changes and the upstream GitHub Commit Patch for details. The patch validates linkname for both symlinks and hardlinks under SECURE EXTRACT MODE, rejecting absolute paths and .. traversal segments.

Workarounds

Ensure $Archive::Tar::INSECURE_EXTRACT_MODE is not set to a truthy value in application code.
Extract untrusted archives inside short-lived containers, chroots, or unprivileged user namespaces that cannot reach sensitive files.
Pre-scan tar archives and reject entries whose linkname is absolute or contains .. before invoking extraction.

bash

# Upgrade Archive::Tar to the patched version via cpanm
cpanm Archive::Tar@3.08

# Verify the installed version
perl -MArchive::Tar -e 'print $Archive::Tar::VERSION, "\n"'

# Ensure secure extract mode is enabled in calling code
perl -e 'use Archive::Tar; $Archive::Tar::INSECURE_EXTRACT_MODE = 0;'