File Injection Vulnerability in Tar Affects Red Hat Products
CVE-2026-5704
5MEDIUM
Key Information:
- Vendor
Red Hat
- Status
- Vendor
- CVE Published:
- 6 April 2026
What is CVE-2026-5704?
A vulnerability exists in Tar that could be exploited by a remote attacker through a specially crafted archive. This flaw allows the attacker to inject hidden files with content fully controlled by them, circumventing pre-extraction checks. Consequently, malicious files could be introduced to the system unnoticed, posing serious security risks.
Affected Version(s)
Red Hat Discovery 2 1788205779
Red Hat Enterprise Linux 10 2:1.35-13.el10_2
Red Hat Enterprise Linux 9 2:1.34-13.el9_8
References
CVSS V3.1
Score:
5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Red Hat would like to thank Guillermo de Angel Garcia for reporting this issue.