Threats Tagged 'cve-2026-42496'

A critical vulnerability (CVE-2026-42496) exists in BINGOS Archive::Tar versions before 3.08 for Perl, where symlinks with attacker-controlled targets outside the extraction directory can be extracted without proper validation. This improper link resolution allows an attacker to cause arbitrary file read or write operations outside the intended extraction path. The vulnerability arises because the function handling symlink creation does not validate the symlink target against absolute paths or directory traversal sequences. Red Hat has issued security advisories and released updated packages to address this issue in their distributions.

This advisory addresses two security vulnerabilities in the Perl 5.32 packages used in Red Hat Enterprise Linux 8. The first vulnerability (CVE-2026-42496) involves a path traversal issue in perl-archive-tar that allows arbitrary file access via crafted symlinks. The second vulnerability (CVE-2026-48962) affects perl-IO-Compress and allows arbitrary code execution through an attacker-controlled output glob. Red Hat has released an important security update to fix these issues in the affected Perl packages.