Is CVE-2026-18508 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-18508?

CVE-2026-18508 has a CVSS v3 severity of MEDIUM (4.4).

Back

CVE-2026-18508

Description

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.