CVE-2026-42497 is a vulnerability in BINGOS Archive::Tar affecting versions prior to 3.08. The issue arises in the _make_special_file() function, which passes the tar header's linkname directly to the link() system call without validating whether the linkname is an absolute path or contains '..' segments. This improper validation allows extraction of hardlinks to paths outside the extraction directory, effectively linking to victim files. Subsequent writes to the extracted file modify the victim file's contents, and the post-extraction chmod, chown, and utime operations apply changes to the victim file's inode. The vulnerability is classified under CWE-59 (Improper Link Resolution Before File Access) and CWE-732 (Incorrect Permission Assignment for Critical Resource).

An attacker can craft a malicious tar archive that, when extracted by a vulnerable Archive::Tar version, creates hardlinks pointing to arbitrary files outside the extraction directory. This enables unauthorized modification of those victim files' contents and metadata, leading to integrity violations. The CVSS score of 7.5 (high) reflects the network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid extracting untrusted tar archives with vulnerable versions of Archive::Tar. Consider using alternative extraction tools that properly validate linknames or manually inspect archives before extraction.