CVE-2026-42497 is a vulnerability in BINGOS Archive::Tar versions before 3. 08 for Perl that allows extraction of hardlinks to attacker-controlled paths outside the intended extraction directory.
@offseq What do you mean, "no patch yet"? (Or "no official patch or remediation guidance is currently available" in your link?) Versions 3.10 and 3.08 of Archive::Tar (released one and four days ago, respectively) are available and contain a fix.
Füsilier Breitlinger
in reply to • • •@offseq What do you mean, "no patch yet"? (Or "no official patch or remediation guidance is currently available" in your link?) Versions 3.10 and 3.08 of Archive::Tar (released one and four days ago, respectively) are available and contain a fix.
See metacpan.org/dist/Archive-Tar/….
Client Challenge
metacpan.org