This vulnerability in tar on Red Hat Enterprise Linux 10 involves the unrestricted upload of files with dangerous types via crafted archives. An attacker can exploit this by creating a malicious archive that injects hidden files with fully attacker-controlled content, circumventing pre-extraction inspection controls. The CVSS 3.1 vector indicates local attack vector with low complexity, requiring low privileges and user interaction, impacting integrity but not confidentiality or availability. The vendor advisory does not provide explicit remediation or patch details at this time.

The vulnerability allows an attacker with local access and user interaction to inject malicious files into the system by bypassing inspection mechanisms during archive extraction. This impacts system integrity by potentially introducing unauthorized or malicious files. There is no direct impact on confidentiality or availability reported. No known exploits are currently in the wild.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-5704 for current remediation guidance. Until an official fix is available, exercise caution when extracting archives from untrusted sources and consider additional inspection or sandboxing measures. No vendor-provided mitigation or temporary fix is currently documented.