CVE-2026-5704 | BDVDB-2026-325004 Detail
Red HatRed Hat Enterprise Linux 10
Description#
A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.
Impact#
Per CVSS v3.1: confidentiality impact none, integrity impact high, availability impact none. Attack vector: local.
Weaknesses#
- CWE-434 Unrestricted Upload of File with Dangerous Type
References#
- https://access.redhat.com/errata/RHSA-2026:61581
- https://access.redhat.com/errata/RHSA-2026:61586
- https://access.redhat.com/errata/RHSA-2026:61783
- https://access.redhat.com/errata/RHSA-2026:66018
- https://access.redhat.com/errata/RHSA-2026:66514
- https://access.redhat.com/errata/RHSA-2026:70390
- https://access.redhat.com/security/cve/CVE-2026-5704
- https://bugzilla.redhat.com/show_bug.cgi?id=2455360
- http://www.openwall.com/lists/oss-security/2026/04/11/10
- http://www.openwall.com/lists/oss-security/2026/04/11/11
- http://www.openwall.com/lists/oss-security/2026/04/12/2
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.