CVE-2026-18508 describes a flaw in GNU tar where the --one-top-level option does not properly confine hardlink targets to the specified top-level directory during archive extraction. Crafted archives can create hardlinks that escape the intended directory boundary and, if a symbolic link exists in the extraction working directory, may allow writing outside the target directory in a single extraction operation. This vulnerability affects Red Hat Hardened Images RPMs and Red Hat Enterprise Linux when extracting untrusted archives with --one-top-level. The flaw is classified under CWE-59 (Improper Link Resolution Before File Access). Red Hat advises avoiding the use of --one-top-level as the sole confinement mechanism for untrusted archives until patched versions are released. The vulnerability has a CVSS v3.1 base score of 4.4 (moderate severity) according to Red Hat's assessment.

An attacker can craft an archive that, when extracted with the --one-top-level option, may cause files to be written outside the intended extraction directory if a symbolic link exists in the working directory. This can lead to unauthorized file overwrite and potential bypass of security mechanisms relying on file integrity. The impact includes limited confidentiality and integrity loss but no availability impact. The vulnerability requires local access and user interaction (extracting the archive).

Red Hat advises not to use the --one-top-level option as the sole confinement mechanism when extracting untrusted archives. Instead, extract archives as an unprivileged user into a newly created empty directory after changing into that directory. Avoid extracting as root from sensitive directories such as the root directory (/). Follow GNU tar security guidance for handling untrusted archives. Fixed packages are not yet available; monitor Red Hat advisories for updates.