This vulnerability in tar involves the ability of a remote attacker to create a specially crafted archive that results in hidden file injection with fully attacker-controlled content. The flaw bypasses mechanisms designed to inspect archives before extraction, allowing malicious files to be introduced without detection. The issue affects numerous specific tar package versions primarily associated with Ubuntu distributions. The CVSS 3.1 vector indicates local attack vector with low complexity, requiring low privileges and user interaction, impacting integrity but not confidentiality or availability.

An attacker who can supply a malicious tar archive may cause the injection of hidden files containing arbitrary content onto a target system. This compromises the integrity of the system by allowing unauthorized files to be introduced without detection by pre-extraction inspection tools. There is no direct impact on confidentiality or availability according to the CVSS vector. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should exercise caution when extracting tar archives from untrusted sources and consider additional manual inspection or sandboxing measures. Monitor official Ubuntu security advisories for updates and apply any released patches promptly.