The perl-Archive-Tar module, which provides object-oriented handling of tar files including support for compressed tar files when IO::Zlib is installed, contains a path traversal vulnerability (CVE-2026-42496). This vulnerability allows an attacker to craft symbolic links within tar archives that lead to arbitrary file access outside the intended extraction directory. Red Hat has issued a security advisory (RHSA-2026:30856) rating this issue as important and has released updated packages for Red Hat Enterprise Linux 9 and its extended update support versions to fix this flaw.

Exploitation of this vulnerability could allow an attacker to access arbitrary files on the system by leveraging crafted symbolic links in tar archives. This could lead to unauthorized disclosure of sensitive information or modification of files if the attacker has the ability to extract malicious tar files. The severity is rated as important by Red Hat, indicating a significant security risk.

Red Hat has released updated perl-Archive-Tar packages for Red Hat Enterprise Linux 9 and its extended update support versions that address this vulnerability. Users should apply these official security updates promptly to remediate the issue. For detailed update instructions, refer to Red Hat's advisory at https://access.redhat.com/articles/11258. No alternative mitigations are indicated in the advisory.