Log in Start free

Vulnerability · Published Aug 3, 2026 · Assigned by redhat

CVE-2026-18477Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape

Medium 4.4

In plain English

A medium-severity security flaw in Red Hat Discovery 2 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 0% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.4Medium
Exploit odds (30 days)<0.1%top 99.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10tar2:1.35-13.el10_2ALSA-2026:61586
AlmaLinux:8tar2:1.30-13.el8_10ALSA-2026:70390
AlmaLinux:9tar2:1.34-13.el9_8ALSA-2026:61581
Debian:12tarno fix listedDEBIAN-CVE-2026-18477
Debian:13tarno fix listedDEBIAN-CVE-2026-18477
Debian:14tarno fix listedDEBIAN-CVE-2026-18477
Rocky Linux:10tar2:1.35-13.el10_2RLSA-2026:61586
Rocky Linux:8tar2:1.30-13.el8_10RLSA-2026:70390
Rocky Linux:9tar2:1.34-13.el9_8RLSA-2026:61581
Ubuntu:22.04:LTStarno fix listedUBUNTU-CVE-2026-18477
Ubuntu:24.04:LTStarno fix listedUBUNTU-CVE-2026-18477
Ubuntu:26.04:LTStarno fix listedUBUNTU-CVE-2026-18477
Ubuntu:26.10tarno fix listedUBUNTU-CVE-2026-18477

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Discovery 2 see references
Red Hat Red Hat Hardened Images see references
Red Hat Red Hat Update Infrastructure 5 see references
Red Hat Red Hat Update Infrastructure 5 see references
Red Hat Red Hat Update Infrastructure 5 see references
Red Hat Red Hat Update Infrastructure 5 see references
Red Hat Red Hat Update Infrastructure 5 see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Hardened Images see references
Red Hat Red Hat Hardened Images see references
Red Hat Red Hat Hardened Images see references
Red Hat Red Hat Hardened Images see references
Red Hat Red Hat Hardened Images see references
Red Hat Red Hat Hardened Images see references
Red Hat Red Hat Hardened Images see references
Red Hat Red Hat Hardened Images see references
Red Hat Red Hat Hardened Images see references
Red Hat Red Hat Hardened Images see references
Red Hat Red Hat OpenShift Container Platform 4 see references
Red Hat Red Hat OpenShift Container Platform 4 see references
Red Hat Red Hat OpenShift Container Platform 5 see references

Weakness: CWE-367 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N

References