CVE-2026-31802

A flaw was found in tar. An attacker can exploit this vulnerability by crafting a malicious tar archive containing a drive-relative symlink. This symlink, such as C:../../../target.txt, can trick the tar utility into writing files outside the intended extraction directory during normal archive extraction, leading to unauthorized file overwrite.

This is a MODERATE impact vulnerability. The tar utility is susceptible to unauthorized file overwrites when processing specially crafted archives containing drive-relative symlinks. As such, it primarily affects integrity (since it can overwrite files and file contents), with no clear indication that availability or confidentiality may be affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.