CVE-2026-12565: Path Traversal in Unarchive Module – Path Validation Bypass

Technical summary

The unarchive module implements archive extraction without performing code-level validation on extracted file paths. Instead, it relies on the external tar utility's handling of path traversal protections. On systems with GNU tar < 1.34, the tar utility permits extraction of archive members with paths containing directory traversal sequences (e.g., '../../../'). The vulnerability is rooted in CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and stems from a fundamental design assumption that external tools will enforce path safety. Since tar behavior varies across platforms and versions, and older versions lack built-in protections, a specially crafted tarball can write files to locations outside the extraction directory. This is distinct from CVE-2025-10284, which addressed similar risks in git-specific contexts but did not remediate the underlying extraction logic.

Business impact

Organizations running applications that process untrusted archive files face risk of filesystem corruption and data integrity violations. An attacker with the ability to provide or inject a malicious archive could overwrite configuration files, application binaries, or shared libraries, leading to application compromise, privilege escalation, or denial of service. The impact is amplified in containerized environments and CI/CD pipelines where base images run vulnerable tar versions and where archives may be processed with elevated privileges. While remote code execution is not directly described, file overwrites can facilitate subsequent exploitation chains.

Affected systems

Systems vulnerable to this issue include those running GNU tar versions below 1.34 paired with applications using the affected unarchive module. Particularly at risk are Ubuntu 20.04 LTS, Debian Buster, CentOS 7, and many official Docker base images that ship with older tar versions. The vulnerability applies to any deployment where the unarchive module processes archives sourced from untrusted or partially-trusted origins (e.g., user uploads, package repositories, external integrations). Air-gapped or internally-isolated systems may face lower practical risk if archives are sourced only from trusted, controlled environments.

Exploitability

Exploitation requires crafting a malicious archive file and delivering it to an application using the vulnerable unarchive module. The CVSS vector indicates high attack complexity (AC:H) and requires user interaction (UI:R), suggesting the attack is not trivial—an attacker must either convince a user to extract a malicious archive or control an archive source that the application consumes. Network accessibility (AV:N) is possible if the application accepts remote archive uploads or fetches archives from a network source. The attack is not particularly difficult to execute once delivery is achieved, as crafting path-traversal payloads in tar archives is well-understood; however, the requirement for specific tar versions and conditions limits widespread exploitation.

Remediation

Immediate remediation requires either upgrading GNU tar to version 1.34 or later on affected systems, or upgrading the application containing the unarchive module if a patched version is available. Since upgrading tar may not be feasible in locked-down environments, the preferred solution is to patch or replace the unarchive module with one that performs code-level path validation before extraction. Validation should canonicalize extracted paths and reject any member whose canonical path falls outside the intended extraction root, regardless of external tool behavior. For organizations unable to patch immediately, restrict archive processing to trusted sources and implement filesystem-level controls (e.g., read-only mounts, chroot jails, or seccomp filters) to prevent unauthorized writes.

Patch guidance

Check with your application vendor for a patched version of the unarchive module that implements explicit path validation. If patches are available, apply them urgently to all systems processing archives from untrusted sources. In parallel, verify your system's tar version (run 'tar --version') and upgrade to GNU tar 1.34 or later where feasible. For containerized deployments, rebuild images from base layers that include the patched tar version. Test patches in non-production environments first, as changes to archive extraction behavior may affect legitimate workflows. If the application vendor has not released a patch, escalate to request one or evaluate alternative archive processing libraries that include built-in path validation.

Detection guidance

Monitor for successful extraction of archive files with path-traversal sequences in their member names (e.g., entries containing '../' or starting with '/'). Enable audit logging for filesystem write operations in directories outside the application's intended extraction path. In containerized environments, monitor for unexpected file modifications in critical locations such as /etc, /usr/bin, or /usr/lib. Set up alerts for archive processing that occurs with elevated privileges. Review application logs for errors or warnings related to archive extraction, as failed attempts to extract to forbidden paths may indicate attack attempts. If available, use filesystem integrity monitoring (e.g., AIDE, Tripwire, or osquery) to detect unauthorized modifications to sensitive files.

Why prioritize this

This vulnerability merits prioritization in environments where untrusted archives are processed, particularly CI/CD pipelines, content management systems, and file-sharing platforms. Although the CVSS score of 5.3 (MEDIUM) reflects moderate impact and attack complexity, the real-world risk is elevated by the prevalence of affected tar versions in production Docker images and long-term-support operating systems. The fact that CVE-2025-10284 addressed a related vector in git but left the underlying flaw unpatched suggests this issue has lingered; patching it prevents both current exploitation and future variants. Organizations should prioritize assessment and patching based on whether their applications process archives from external or user-controlled sources; those with locked-down, internally-sourced archives may defer to a secondary patch cycle.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects a MEDIUM severity assessment. The attack vector is network-based (AV:N), allowing remote delivery of a malicious archive. Attack complexity is high (AC:H), indicating the attacker must overcome conditions such as specific tar versions or environmental configurations. Privileges are not required (PR:N) and the scope is unchanged (S:U). User interaction is required (UI:R), meaning an attacker must trick a user into extracting the archive or control an archive source. The impact vector shows no confidentiality loss (C:N) but high integrity impact (I:H), reflecting the ability to overwrite files. There is no availability impact (A:N) assigned, though file overwrites could indirectly cause denial of service. The score appropriately balances the real risk of filesystem corruption against the practical barriers to exploitation.

Frequently asked questions