This vulnerability in the tar utility on Red Hat Enterprise Linux 10 involves unrestricted upload of files with dangerous types via crafted malicious archives. An attacker can bypass pre-extraction inspection mechanisms to inject hidden files containing fully attacker-controlled content. The CVSS 3.1 vector indicates the attack requires local access with low complexity and some user interaction, and impacts integrity without affecting confidentiality or availability. The vendor advisory does not specify an official fix or patch status.

The impact is limited to integrity compromise, where an attacker with local privileges and some user interaction can inject malicious files undetected by inspection mechanisms. There is no impact on confidentiality or availability reported. No known exploitation in the wild has been documented.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-5704 for current remediation guidance. Until an official fix is released, users should exercise caution when extracting archives from untrusted sources and consider additional manual inspection or sandboxing measures. No vendor advisory states that no action is required or that the issue is already mitigated.