CVE-2026-42496 is a critical flaw (CVSS 9.1) in Perl Archive::Tar before version 3.08. It extracts symbolic links whose targets lie outside the extraction directory, so a later read or write through that name reaches a path the attacker picked. Upgrade to 3.08, or install your distribution's patched package.
What's affected
The record says Archive::Tar versions before 3.08 are affected, and the project change log for 3.08 is among its references. The NVD product field for this record is garbled, so I rely on the description for the package name.
Red Hat has published errata for it (RHSA-2026:30851, RHSA-2026:30852 and RHSA-2026:30856 appear in the record), so Red Hat family systems should take the distribution update. Archive::Tar ships with the Perl core, which means many servers carry it even when nobody installed it on purpose.
How to check if you're exposed
Print the installed module version:
perl -MArchive::Tar -e 'print Archive::Tar->VERSION, "\n"'
Anything below 3.08 is in range. Then check whether your code extracts archives from sources you do not control. Search your repositories for Archive::Tar and for calls to extract or extract_archive, and look at build scripts, upload handlers and package tools written in Perl.
On Red Hat family systems, compare your perl packages with the errata listed in the record.
What to do now
- Update Archive::Tar to 3.08 or later, from CPAN or from your distribution's updated perl packages.
- Find every place your Perl code extracts a tar file, and list which of those handle untrusted archives.
- Until you are patched, avoid extracting untrusted tarballs with Archive::Tar, or extract them inside a throwaway container.
- Do not run extraction as a privileged user.
- Rebuild container images that bundle an older perl.
Why it matters
The weakness classes are CWE-22, path traversal, and CWE-59, link following. The record explains the gap clearly. The secure extract mode checks file paths for regular files, but the symlink code passes the link target from the tar header straight to the operating system. A target such as an absolute path or one with parent directory segments is not examined.
The danger comes in two steps. First a link is unpacked inside the safe folder. Then a later entry, or later code, opens a file through that link name and lands somewhere else. That is why a defence that only checks file names is not enough. The KEV flag is false and I found no report of exploitation.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is Archive::Tar only a problem if I install it from CPAN?
No. It is part of core Perl, so many systems have it. Check the version with the command above.
Why does the secure extract mode not help?
Per the record, its path check covers regular file extraction but not the target of a symlink.
Sources
- Archive::Tar 3.08 change log (listed in the NVD record, not retrieved)
- Red Hat erratum RHSA-2026:30851 (listed in the NVD record, not retrieved)
- Gold page for this CVE
Last reviewed: 19 October 2026.
