Archive::Tar versions before 3.08 can extract symbolic links that point to arbitrary locations outside the destination directory. The code passes the tar header’s linkname to symlink() without validating absolute paths or traversal components. If an attacker supplies a crafted tar archive, the symlink will be created, and subsequent file operations on the extracted name can read or overwrite the attacker‑chosen file. This flaw enables an attacker to read sensitive files or corrupt data on the host, potentially allowing further exploitation.

The affected component is the Perl module Archive::Tar supplied by the BINGOS vendor. All versions prior to 3.08 are vulnerable; affected releases include 3.07 and earlier.

No CVSS score or EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, indicating no widespread exploitation. The flaw is local; it requires an attacker to supply a malicious tar archive and trigger extraction, typically from an untrusted source. If extraction occurs with elevated privileges, the attacker can use the symlink to overwrite critical files or gain read access to sensitive data. The lack of automated exploitation reports suggests the risk remains theoretical until an attacker demonstrates the attack, but the impact could be severe if used.