GNU tar Vulnerability Allows Security Bypass - CVSS 5.0 Medium
Summary
CERT-Bund issued security advisory WID-SEC-2026-1057 regarding a vulnerability in GNU tar that allows a local attacker to bypass security measures. The vulnerability carries a CVSS Base Score of 5.0 (medium) and Temporal Score of 4.6 (medium). Remote attack is not possible. Affected systems include Linux, UNIX, and Windows operating systems.
What changed
CERT-Bund published security advisory WID-SEC-2026-1057 describing a vulnerability in GNU tar that enables a local attacker to bypass security mechanisms. The vulnerability has a CVSS Base Score of 5.0 (medium) and Temporal Score of 4.6 (medium). Remote attack capability is not present.
Affected parties using GNU tar on Linux, UNIX, or Windows systems should monitor for vendor updates and apply patches once available. Organizations should assess their exposure to this vulnerability as part of their ongoing security patch management processes.
What to do next
- Monitor vendor security advisories for patches
- Apply available patches when released
Archived snapshot
Apr 15, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
[WID-SEC-2026-1057] GNU tar: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen CVSS Base Score 5.0 (mittel) CVSS Temporal Score 4.6 (mittel) Remoteangriff nein Datum 12.04.2026 Stand 13.04.2026 Mitigation nein
Betroffene Systeme
Betriebssystem
- Linux
- UNIX
- Windows
Produktbeschreibung
GNU Tar ist ein populäres Programm zur Verarbeitung von Archivdateien. Es ist in vielen Linux Distributionen enthalten.
Produkte
12.04.2026
- Open Source GNU tar
Angriff
Angriff
Ein lokaler Angreifer kann eine Schwachstelle in GNU tar ausnutzen, um Sicherheitsvorkehrungen zu umgehen. CVE Informationen Versionshistorie Feedback zum Advisory geben
Related changes
Get daily alerts for CERT-Bund Security Advisories
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
Source
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from CERT-Bund.
The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when CERT-Bund Security Advisories publishes new changes.
Subscribed!
Optional. Filters your digest to exactly the updates that matter to you.