Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite

Summary

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.

Timeline

1. Aug 3, 2026, 2:51 PM UTCCVE published
2. Aug 3, 2026, 4:02 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Sep 22, 2026, 9:29 PM UTCRecord last updated

Affected versions

• tar

  Version range not reported

• tar

  Version range not reported

• tar

  Version range not reported

• discovery/discovery-server-rhel9

  Version range not reported

• tar-main

  Version range not reported

• rhui5/cds-kubernetes-rhel9

  Version range not reported

• rhui5/cds-rhel9

  Version range not reported

• rhui5/haproxy-rhel9

  Version range not reported

• rhui5/installer-rhel9

  Version range not reported

• rhui5/rhua-rhel9

  Version range not reported

• tar

  Version range not reported

• tar

  Version range not reported

• aardvark-dns

  Version range not reported

• chunkah

  Version range not reported

• grafana12.4

  Version range not reported

• grafana13.1

  Version range not reported

• netavark

  Version range not reported

• nodejs26

  Version range not reported

• python-cryptography

  Version range not reported

• rust

  Version range not reported

• rust-rpm-sequoia

  Version range not reported

• yarnpkg

  Version range not reported

• openshift/ose-rhel-coreos-8

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

References 8