CVE-2026-5704CWE-434unrestricted-file-upload

CVE-2026-5704

Medium · published April 6, 2026

CVSS v3.1
5.0
EPSS
0%
Percentile
33.2
In the wild
Unconfirmed
What it is

A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00401 · 33.2th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-04-06T20:16Z
Affected products (7)
ProductVersionsFixed in
gnu/tarall versions—
redhat/hardened_imagesall versions—
redhat/enterprise_linuxall versions—
redhat/enterprise_linuxall versions—
redhat/enterprise_linuxall versions—
redhat/enterprise_linuxall versions—
redhat/enterprise_linuxall versions—
References (11)
EPSS history
Timeline
  • 06 APR 15:17Z
    Tar: tar: hidden file injection via crafted archives
    cvelistv5