CVE-2026-5704 describes a flaw in the tar archive utility where crafted archive files can cause hidden file injection with fully attacker-controlled content. This vulnerability bypasses pre-extraction inspection mechanisms, allowing an attacker to introduce malicious files onto a system undetected. The issue affects numerous specific versions of tar in Ubuntu and Red Hat distributions. The vulnerability has been assigned a CVSS 3.1 base score of 5.0 (medium severity) with an attack vector of local, low complexity, requiring low privileges and user interaction. Both Red Hat and Ubuntu have published advisories with available patches to remediate the issue.

The vulnerability allows an attacker with local access to craft malicious tar archives that inject hidden files containing attacker-controlled content, bypassing inspection mechanisms before extraction. This can lead to unauthorized modification of system files or introduction of malicious files, impacting system integrity. There is no direct confidentiality or availability impact reported. The flaw requires local access and user interaction to exploit.

Apply the official patches provided by Red Hat and Ubuntu to affected tar package versions. Avoid extracting archives from untrusted sources. If processing untrusted archives is necessary, perform extraction within sandboxed environments to limit potential impact. Standard system updates on affected distributions will include the necessary fixes.