Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
5 versions affected across 3 products
CVE-2026-18508 Hardlink Escape Vulnerability in GNU tar With --one-top-level Option https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-18508
Post summary
The post references CVE-2026-18508, noting a hardlink escape flaw in GNU tar’s --one‑top‑level option and linking to a vulnerability details page, but it does not provide any PoC, exploit, patch, or active exploitation information.
5 of 5 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | gnu | tar | 1.35 | - | - |
| OS | redhat | enterprise_linux | 10.0 | - | - |
| OS | redhat | enterprise_linux | 8.0 | - | - |
| OS | redhat | enterprise_linux | 9.0 | - | - |
| App | redhat | openshift_container_platform | 4.0 | - | - |