Gnupg2: gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. (CVE-2026-105712)
Description
A vulnerability in gpgtar component of GnuPG before version 2.5.19 allows file overwrite via crafted archive data. When extracting an untrusted archive with the --directory (-C) option into an existing directory containing a symlink, gpgtar may follow the symlink and overwrite files outside the intended extraction directory. This behavior is limited by the filesystem permissions of the user performing extraction. Extracting into a fresh empty directory does not pose this risk. The issue has a low severity score and no known exploits in the wild.
CVSS v3.1
Score 3.6low
Affected software
pkg:deb/ubuntu/gnupg2?arch=source&distro=esm-infra/xenialpkg:deb/ubuntu/gnupg2?arch=source&distro=esm-infra/bionicpkg:deb/ubuntu/gnupg2?arch=source&distro=esm-infra/focalpkg:deb/ubuntu/gnupg2?arch=source&distro=jammypkg:deb/ubuntu/gnupg2?arch=source&distro=noblepkg:deb/ubuntu/gnupg2?arch=source&distro=stonkingpkg:deb/ubuntu/gnupg2?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The gpgtar utility in GnuPG versions prior to 2.5.19 contains a vulnerability that can lead to arbitrary file overwrite. Specifically, when extracting an archive with the --directory option into a directory that contains pre-existing symbolic links, gpgtar may follow these symlinks and write files outside the target extraction directory. This can be exploited by crafting an archive with malicious data to overwrite files accessible by the extraction user. The vulnerability is constrained by the user's filesystem permissions and does not occur when extracting into a new empty directory. The CVSS v3.1 base score is 3.6, indicating low severity.
Potential Impact
An attacker who can supply a crafted archive to be extracted by gpgtar may cause files outside the intended extraction directory to be overwritten, potentially leading to limited integrity impact. The overwrite capability is restricted by the permissions of the user performing the extraction, so privilege level limits the scope of impact. There is no confidentiality impact, and availability impact is low. No known exploits are reported in the wild.
Mitigation Recommendations
Upgrade GnuPG to version 2.5.19 or later where this vulnerability is fixed. Until then, avoid extracting untrusted archives with gpgtar using the --directory (-C) option into directories containing pre-existing symbolic links. Extract archives into fresh empty directories to prevent symlink traversal and file overwrite risks.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-105712
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:Pro:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:26.10","Ubuntu:26.04:LTS"]
- Cvss Version
- 3.1
Threat ID: 6ad3f4f02cdf04f656656e22
Added to database: 10/17/2026, 22:21:36 UTC
Last enriched: 10/17/2026, 22:39:48 UTC
Last updated: 10/17/2026, 22:39:48 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.