CVE-2026-18508
Medium
Description
A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.
SeverityMedium
CVSS4.4
Exploit probability—
Product
Gnu Tar
PublishedAug 3, 2026
First seenAug 3, 2026
Weakness typeCWE-59Improper link resolution
How to fix
Vendor advisories
- access.redhat.com/errata/RHSA-2026:50807
- access.redhat.com/security/cve/CVE-2026-18508
- bugzilla.redhat.com/show_bug.cgi?id=2509843
- access.redhat.com/errata/RHSA-2026:61581
- access.redhat.com/errata/RHSA-2026:61586
- access.redhat.com/errata/RHSA-2026:61783
- access.redhat.com/errata/RHSA-2026:66018
- access.redhat.com/errata/RHSA-2026:70390
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gnu tar | 1.35 | — |
| redhat openshift_container_platform | 4.0 | — |
| redhat enterprise_linux | 8.0, 9.0, 10.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.