CVE-2026-105712
Fixed in a distro release EPSS <1%CVSS 3.6
gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.
Products: gnupg
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | gnupg2 | no fix |
| Debian 13 | gnupg2 | no fix |
| Debian 14 | gnupg2 | 2.4.9-8 |
| Red Hat hummingbird 1 | gnupg2 | 0:2.4.9-18.1.hum1 |
| Red Hat hummingbird 1 | gnupg2-dirmngr | 0:2.4.9-18.1.hum1 |
| Red Hat hummingbird 1 | gnupg2-g13 | 0:2.4.9-18.1.hum1 |
| Red Hat hummingbird 1 | gnupg2-gpg-agent | 0:2.4.9-18.1.hum1 |
| Red Hat hummingbird 1 | gnupg2-gpgconf | 0:2.4.9-18.1.hum1 |
| Red Hat hummingbird 1 | gnupg2-keyboxd | 0:2.4.9-18.1.hum1 |
| Red Hat hummingbird 1 | gnupg2-scdaemon | 0:2.4.9-18.1.hum1 |
| Red Hat hummingbird 1 | gnupg2-smime | 0:2.4.9-18.1.hum1 |
| Red Hat hummingbird 1 | gnupg2-utils | 0:2.4.9-18.1.hum1 |
| Red Hat hummingbird 1 | gnupg2-verify | 0:2.4.9-18.1.hum1 |
| Red Hat hummingbird 1 | gnupg2-wks | 0:2.4.9-18.1.hum1 |
| Ubuntu 22.04 LTS | gnupg2 | no fix |
| Ubuntu 24.04 LTS | gnupg2 | no fix |
| Ubuntu 26.04 LTS | gnupg2 | no fix |
| Ubuntu 26.10 | gnupg2 | no fix |
| Ubuntu Pro 16.04 LTS | gnupg2 | no fix |
| Ubuntu Pro 18.04 LTS | gnupg2 | no fix |
| Ubuntu Pro 20.04 LTS | gnupg2 | no fix |