CVE-2026-5704 Tar: tar: hidden file injection via crafted archives
Attackers can inject hidden files with controlled content via crafted archives, bypassing inspection mechanisms in tar.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-5704?
CVE-2026-5704 is a medium-severity vulnerability in Redhat Enterprise Linux, published on 6 Apr 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.
Weakness: CWE-434
Which versions are affected by CVE-2026-5704?
It affects 3 products.
Linux distribution packages (16)
tar Red Hat:hummingbird:1 | All versions | 0:1.35-10.hum1 |
tar SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 1.34-150000.3.42.1 |
tar SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 1.34-150000.3.42.1 |
tar SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | All versions | 1.34-150000.3.42.1 |
tar SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | All versions | 1.34-150000.3.42.1 |
tar SUSE:Linux Enterprise Micro 5.3 | All versions | 1.34-150000.3.42.1 |
tar SUSE:Linux Enterprise Micro 5.4 | All versions | 1.34-150000.3.42.1 |
tar SUSE:Linux Enterprise Micro 5.5 | All versions | 1.34-150000.3.42.1 |
tar SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 1.34-150000.3.42.1 |
tar SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 1.34-150000.3.42.1 |
tar SUSE:Linux Enterprise Server 15 SP5-LTSS | All versions | 1.34-150000.3.42.1 |
tar SUSE:Linux Enterprise Server 15 SP6-LTSS | All versions | 1.34-150000.3.42.1 |
tar SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | All versions | 1.34-150000.3.42.1 |
tar SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | All versions | 1.34-150000.3.42.1 |
tar SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | All versions | 1.34-150000.3.42.1 |
tar openSUSE:Tumbleweed | All versions | 1.35-8.1 |
Products include Gnu Tar, Redhat Enterprise Linux, Redhat Hardened Images.
How do I fix CVE-2026-5704?
Apply the vendor's patch.
Is CVE-2026-5704 being exploited?
There is no known exploitation of CVE-2026-5704 in the wild and no public exploit code.
Other vulnerabilities in Redhat Enterprise Linux
Sources
Also known as AZL-98237, CLSA-2026-1791450288, CLSA-2026-1791452899, DEBIAN-CVE-2026-5704, ECHO-6544-7e09-569c, GHSA-jqqw-37x4-9rwj and 12 more.