Critical Security Update for perl-Archive-Tar: Path Traversal Vulnerability
Summary
ALSA-2026:30856: Important: perl-Archive-Tar security update. Affects perl-Archive-Tar versions < 2.38-6.el9_8.1. Fixed in 2.38-6.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
perl-Archive-Tar is a Perl module that provides an object-oriented interface for handling tar files. It allows users to create, manipulate, and extract tar archives easily. The module also supports compressed tar files when the IO::Zlib module is installed. However, a recent security issue has been identified that could allow unauthorized access to files on the system, making it crucial for users to address this vulnerability promptly.
Vulnerability Detail
The vulnerability, identified as CVE-2026-42496, arises from a path traversal issue caused by crafted symlinks within tar files. This flaw allows attackers to exploit the Archive::Tar module to gain arbitrary access to files outside of the intended directory structure. If successfully exploited, this could lead to unauthorized data exposure or modification, posing significant risks to system integrity and confidentiality.
How To Fix
Minimum fixed version
2.38-6.el9_8.1
This is the first release that contains the fix.
sudo dnf update perl-Archive-TarTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid processing untrusted tar files or those from unknown sources until the package is updated. Additionally, implementing strict file permissions and monitoring file access can help mitigate potential risks.
Conclusion
The perl-Archive-Tar module has a critical vulnerability that requires immediate attention. Users are advised to update to the latest patched version to protect against potential exploitation. By following the recommended steps and utilizing tools like Vulert, users can enhance their security posture and safeguard their systems.
See every vulnerability recorded for perl-Archive-Tar →
FAQ
CVE-2026-42496 is a security vulnerability in the perl-Archive-Tar module that allows for path traversal via crafted symlinks, potentially leading to unauthorized file access.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary risk is unauthorized access to sensitive files on the system, which could lead to data breaches or system compromise.
Yes, avoid processing untrusted tar files and implement strict file permissions to limit access to sensitive data.
It is recommended to regularly check for updates to your packages, ideally on a weekly basis, to ensure you have the latest security patches.
Related vulnerabilities
Recent vulnerabilities recorded for perl-Archive-Tar.
