Executive brief
Archive::Tar is a Perl library used to create and extract compressed tar archives. A vulnerability in versions prior to 3.08 allows a specially crafted archive to create symbolic links that point to locations outside of the intended extraction folder. If an application subsequently interacts with these files, an attacker could potentially read or overwrite sensitive system files, leading to data exposure or system instability.
Technical details
A path traversal vulnerability exists in Archive::Tar's _make_special_file() function. The library fails to validate the 'linkname' (target) of symbolic and hard links against absolute paths or parent directory ('..') segments, even when 'secure-extract' mode is enabled. An attacker can provide a malicious tarball containing a symlink pointing to a sensitive location (e.g., /etc/passwd). If the calling application later opens the extracted symlink for reading or writing, it will inadvertently access the attacker's chosen path. This was fixed in version 3.08 by adding validation checks for link targets in secure mode.
Affected products
- Perl CPAN Archive::Tar before 3.08
Timeline
- 2026-05-21: patched: Fix committed to repository
- 2026-05-22: advisory: Version 3.08 released on CPAN
- 2026-05-26: disclosed: NVD publication date