5.5

CVE-2026-5704: gnu tar

CVSS: 5.5v3.1MediumModified
AliasesMGASA-2026-0168SUSE-SU-2026:2714-1RHSA-2026:66514
Published 06-04-2026Last modified 22-09-2026
Open JSON

Vulnerability summary

CVE-2026-5704 is a medium (CVSS 5.5) vulnerability in gnu tar. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 32.9% of scored vulnerabilities. 3 public exploits are recorded.

Overall risk
32/100
0100
Medium · default modelHow is this calculated?
CVSS score
5.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.40%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits3reference

Advisory lineage

Upstream 0 · Downstream 6 · Related 5
OPENSUSE-SU-2026:21070-1RHSA-2026:61581RHSA-2026:61586RHSA-2026:70390SUSE-SU-2026:22289-1SUSE-SU-2026:22377-1

Timeline

  1. 06-04-2026
    PublishedVulnerability first disclosed.
  2. 22-09-2026
    Last modifiedVulnerability information updated.

Description

A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.40%

Chance of exploitation in the next 30 days

Percentile

33%

Versus all other CVEs

30-day change

0.00 pp

From 0.40% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.40%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

3 found
  • referenceUnverified

    Exploit Reference (bugzilla.redhat.com)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (openwall.com)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (openwall.com)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Suse14 products
  • tar&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 1.34-150000.3.42.1
  • tar&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 1.34-150000.3.42.1
  • tar&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS< 1.34-150000.3.42.1
  • tar&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS< 1.34-150000.3.42.1
  • tar&distro=SUSE Linux Enterprise Micro 5.3< 1.34-150000.3.42.1
Chainguard3 products
  • gnutar< 1.35-r9
  • gnutar-docAll versions (No fix recorded)
  • gnutar-rmtAll versions (No fix recorded)
Redhat3 products
Wolfi3 products
  • gnutar< 1.35-r9
  • gnutar-docAll versions (No fix recorded)
  • gnutar-rmtAll versions (No fix recorded)
Debian1 product
  • tarAll versions (No fix recorded)
Gnu1 product
Mageia1 product
  • tar< 1.35-4.mga9
Opensuse1 product
  • tar&distro=openSUSE Tumbleweed< 1.35-8.1
Ubuntu1 product
  • tarAll versions (No fix recorded) | < 1.27.1-1ubuntu0.1+esm6 | < 1.28-2.1ubuntu0.2+esm5 | < 1.29b-2ubuntu0.4+esm3 | < 1.30+dfsg-7ubuntu0.20.04.4+esm2 | < 1.34+dfsg-1ubuntu0.1.22.04.5 | < 1.35+dfsg-3ubuntu0.3 | < 1.35+dfsg-4ubuntu0.3 | < 1.27.1-1ubuntu0.1+esm7 | < 1.28-2.1ubuntu0.2+esm6 | < 1.29b-2ubuntu0.4+esm4 | < 1.30+dfsg-7ubuntu0.20.04.4+esm3 | < 1.34+dfsg-1ubuntu0.1.22.04.6 | < 1.35+dfsg-3ubuntu0.4 | < 1.35+dfsg-4ubuntu0.4

9 vendors · 28 products

References

32 links
Show all 32 references