Critical Path Traversal Vulnerability in perl-Archive-Tar Package
Summary
ALSA-2026:30857: Important: perl-Archive-Tar security update. Affects perl-Archive-Tar versions < 3.02-512.el10_2.1. Fixed in 3.02-512.el10_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
perl-Archive-Tar is a Perl module that provides an object-oriented interface for handling tar files. It simplifies the process of creating, manipulating, and extracting tar archives, including support for compressed files when the IO::Zlib module is present. This package is widely used in various applications for file archiving and distribution, making its security crucial for maintaining the integrity of data management processes.
Vulnerability Detail
The vulnerability identified as CVE-2026-42496 allows for path traversal via crafted symlinks, which can lead to arbitrary file access on the system. This means that an attacker could potentially exploit this vulnerability to read or modify files outside of the intended directory structure, posing significant risks to data security and system integrity. The issue arises from insufficient validation of file paths when processing tar files, making it critical for users to address this vulnerability promptly.
How To Fix
Minimum fixed version
3.02-512.el10_2.1
This is the first release that contains the fix.
sudo dnf update perl-Archive-TarTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing untrusted tar files or implement additional validation checks on file paths before extraction. However, this is not a substitute for applying the patch.
Conclusion
The perl-Archive-Tar package has a critical vulnerability that can lead to path traversal and arbitrary file access. Users must update to the patched version to mitigate risks. For ongoing monitoring of vulnerabilities, consider using Vulert, which can alert you in real-time for open-source vulnerabilities in your software.
See every vulnerability recorded for perl-Archive-Tar →
FAQ
CVE-2026-42496 is a security vulnerability in the perl-Archive-Tar package that allows for path traversal through crafted symlinks, leading to arbitrary file access.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to sensitive files, potential data breaches, and the ability for attackers to manipulate files on the system.
Yes, a patch is available in version 3.02-512.el10_2.1 of the perl-Archive-Tar package. Users are encouraged to update to this version.
If immediate updates are not possible, avoid processing untrusted tar files and implement additional validation checks on file paths as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for perl-Archive-Tar.
