3.6
Low
CVE-2026-105712 gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive
Description
gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| GnuPG 2.5 | earliest → < 2.5.19 | 2.5.19 |
References
- static.dev.gnupg.org static.dev.gnupg.org
- github.com github.com
- lists.gnupg.org lists.gnupg.org
Timeline
- Published
- Last modified
Other CVEs of GnuPG
The 9 CVEs of GnuPG →
CVE-2026-118131
CVE-2026-118131
9.8
Critical
CVE-2026-57062
CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM…
2.9
Low
CVE-2026-24883
In GnuPG before 2.5.17, a long signature packet length causes parse_signature to return success with sig->data[] set…
3.7
Low
CVE-2026-24882
In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command…
8.4
High