{"id":"CVE-2026-105712","published":"2026-10-05T19:17:19.527","lastModified":"2026-10-06T16:00:36.547","description":"gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.","cvssScore":3.6,"cvssSeverity":"LOW","cvssVector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","cwes":["CWE-61"],"vendors":[],"products":[],"references":[{"url":"https://github.com/gpg/gnupg/commit/7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88","tags":[]},{"url":"https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000504.html","tags":[]},{"url":"https://static.dev.gnupg.org/T8159.html","tags":[]}],"exploitRefs":[{"url":"https://github.com/gpg/gnupg/commit/7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88","tags":[]}],"hasPoc":true,"ai":null}