Threats affecting pkg:rpm/redhat/perl-Archive-Tar

A critical vulnerability (CVE-2026-42496) exists in BINGOS Archive::Tar versions before 3.08 for Perl, where symlinks with attacker-controlled targets outside the extraction directory can be extracted without proper validation. This improper link resolution allows an attacker to cause arbitrary file read or write operations outside the intended extraction path. The vulnerability arises because the function handling symlink creation does not validate the symlink target against absolute paths or directory traversal sequences. Red Hat has issued security advisories and released updated packages to address this issue in their distributions.