TOCTOU Vulnerability in GNU Tar Backup Process

CVE-2026-18477

What is CVE-2026-18477?

A TOCTOU vulnerability exists within GNU tar's handling of the incremental dumpdir 'X' rename function. This flaw enables local attackers, who have write access to a directory that is being backed up, to manipulate the restore process on a system. When files or directories are restored, an attacker can influence where these files are created, renamed, or overwritten, potentially leading to unauthorized modifications. This vulnerability does not necessitate the attacker to alter the backup archive itself, which exacerbates the risk as standard backup and restore procedures do not alleviate the issue, particularly if a new directory is created during extraction without the -P option.

References