The vulnerability in Archive::Tar versions prior to 3.08 arises because the _make_special_file() function passes the tar header's linkname directly to symlink() without validating whether the target path is absolute or contains directory traversal sequences (e.g., '..'). The secure-extract mode, which guards regular file extraction, does not apply to symlink targets. Consequently, an attacker can craft a tar archive with malicious symlinks that point outside the extraction directory, enabling subsequent file operations on arbitrary paths chosen by the attacker. This is classified under CWE-59 (Improper Link Resolution Before File Access) and CWE-22 (Path Traversal). The CVSS v3.1 score is 9.1 (critical), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impact.

An attacker can create a malicious tar archive that, when extracted by vulnerable versions of Archive::Tar, creates symbolic links pointing outside the extraction directory. This can lead to arbitrary file read or write operations on the system, potentially compromising confidentiality and integrity of files. The vulnerability does not impact availability. The CVSS score of 9.1 indicates a critical severity level.

Red Hat has issued security advisories and updates addressing this vulnerability. Updated packages for perl-Archive-Tar are available for Red Hat Enterprise Linux 10 and related variants. Users should apply these official patches to remediate the issue. Refer to Red Hat advisory RHSA-2026:30857 and the linked article https://access.redhat.com/articles/11258 for update instructions. Patch status is confirmed by the vendor advisories. No alternative mitigations are specified.