Path Traversal Vulnerability in Archive Extraction for GNU Tar by Various Vendors

CVE-2026-12565

What is CVE-2026-12565?

The vulnerability in the internal module's archive extraction commands arises from a lack of code-level validation on the extracted file paths. This oversight relies heavily on external tools like GNU tar, which exhibit inconsistent behaviors across different platforms. Specifically, on systems using GNU Tar versions below 1.34, such as Ubuntu 20.04, Debian Buster, and CentOS 7, a maliciously crafted archive can exploit this flaw to write files outside the intended extraction directory, posing significant security risks.

References