Loading story…
A flaw in GNU tar 1.35 allows a crafted archive to show one set of contents during listing while extracting additional hidden files. The issue stems from a desynchronization between tar -t and tar -x: listing honors the size field for some non-data-bearing typeflags and skips data blocks, while extraction ignores that size and treats the same blocks as new headers. Researchers said the behavior affects symlink, character device, block device, and FIFO entries, but not directory entries, enabling hidden file injection with an archive reportedly smaller than 3 KB.
The bug was disclosed on the GNU bug-tar and oss-sec mailing lists, where Red Hat was reported to have assigned CVE-2026-5704. A patch from GNU tar maintainer Paul Eggert was published to the GNU tar mailing list and committed to the upstream repository. Follow-up discussion on oss-sec also noted maintainer skepticism about parts of the original report and broader concerns about low-quality, possibly LLM-generated vulnerability submissions, but the technical issue and upstream fix were separately referenced in the disclosure and source commit.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
In an April 12, 2026 reply on oss-sec, GNU tar maintainer Paul Eggert said the report was on his review list but described much of the underlying bug report as "AI slop," making it a low-priority item for him. The discussion reflected maintainer skepticism rather than confirmation of the vulnerability.
The disclosure and follow-up discussion said Paul Eggert provided a patch for the issue and that it was published on the GNU tar mailing list and in the tar git repository. A corresponding tar.git commit is included among the references.
A report describing a GNU tar listing/extraction desynchronization issue that could enable hidden file injection was posted to the bug-tar mailing list. Later disclosures explicitly referenced this earlier bug-tar report as the initial appearance of the issue.
An oss-sec discussion noted that Red Hat appeared to have assigned CVE-2026-5704 to the GNU tar listing/extraction desynchronization issue. The CVE reference was discussed in follow-up mailing list traffic rather than as a formal vendor announcement in the provided sources.
An oss-sec disclosure described a GNU tar 1.35 issue where `tar -t` and `tar -x` handle certain archive entries differently, allowing files to be extracted that were not shown during listing. The post said the flaw affected symlink, character device, block device, and FIFO entries and could be triggered with a crafted archive smaller than 3 KB.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourcecgit.git.savannah.gnu.org
Open sourcelists.gnu.org
Open sourcelists.gnu.org
Open sourcelists.gnu.org
Open sourcelists.gnu.org
Open sourceseclists.org
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Vim disclosed a medium-severity command injection flaw in its `tar.vim` plugin, tracked as **CVE-2026-46483** and **GHSA-2fpv-9ff7-xg5w**, affecting versions earlier than **9.2.479**. The bug is in `tar#Vimuntar()` in `runtime/autoload/tar.vim`, where `.tgz` archive filenames are passed to shell commands such as `gunzip` and `gzip -d` using `shellescape()` without the required special handling, allowing Vim command-line special-character expansion on Unix-like systems. A successful attack can execute arbitrary shell commands with the privileges of the user running Vim if a victim has the tar plugin enabled, has a malicious archive on disk, and manually runs the non-routine `:Vimuntar` command. The issue was reported and analyzed by **Aisle Research**, disclosed by **Christian Brabandt**, and fixed in **Vim patch v9.2.479**.
Jun 29, 2026
Researchers disclosed **CVE-2026-48095**, a critical heap buffer overflow in 7-Zip affecting version `26.00` and earlier that can lead to application crashes, denial of service, or arbitrary code execution. The bug, reported by Jaroslav Lobačevski of GitHub Security Lab and tracked in advisory `GHSL-2026-140`, resides in the NTFS archive handler’s `CInStream::GetCuSize()` logic, where an under-allocation can shrink a buffer to 1 byte before a later operation writes up to 256 MB of attacker-controlled data into it. The resulting heap corruption can overwrite adjacent objects, including a stream object’s **vtable** pointer, creating a path to code execution. The vulnerability can be triggered simply by opening a specially crafted file because 7-Zip uses signature-based fallback detection and may route files disguised as `.7z`, `.zip`, or `.rar` into the vulnerable NTFS parser regardless of extension. Reports say both 32-bit and 64-bit builds are affected, with 64-bit systems that have sufficient memory more likely to reach reliable code execution, while lower-memory systems may instead crash. Public disclosure included technical details and a Python proof-of-concept generator, raising the risk of weaponization; the issue carries a **CVSS 3.1 score of 8.8**, and users are being urged to update 7-Zip and avoid opening untrusted archives.
Jun 29, 2026
The Rust Security Response Team disclosed **Cargo** vulnerabilities tracked as `CVE-2026-5222` and `CVE-2026-5223`, highlighting risks in how Rust tooling processes package archives from **third-party registries**. In the published details for `CVE-2026-5223`, Cargo was found to mishandle symlinks inside crate tarballs, allowing a malicious crate to overwrite the cached source of another crate from the same registry by extracting files outside its intended cache path. The issue does **not** affect `crates.io`, which already blocks crates containing symlinks, but it affects Cargo versions shipped before **Rust 1.96.0**; the fix rejects extraction of any symlink found in crate tarballs. The disclosures align with a separate advisory affecting the Rust package **astral-tokio-tar**, where a **PAX header desynchronization** bug in versions before `0.6.2` can cause tar archives to be interpreted differently from other implementations. That flaw can let attackers hide or reveal archive members unexpectedly and potentially smuggle files onto a victim filesystem during extraction. Together, the advisories underscore a broader supply-chain risk in Rust archive handling: malformed tar metadata and symlink processing can let malicious packages alter extracted contents in ways developers and automated tooling may not expect. Users are advised to upgrade to fixed releases and, where upgrades are not yet possible, audit registry content and block symlinks in published crates.
Jun 29, 2026