Archive::Tar modules before version 3.08 contain a misuse of symlink validation that corresponds to CWE-22 (Path Traversal) and CWE-59 (Improper Handling of Symbolic Links). The internal routine _make_special_file() forwards the linkname from a tar header directly to symlink() without checking whether it is absolute or contains directory‐separating components. An attacker can therefore craft a tar archive that creates a symbolic link pointing to any location on the file system, including files outside the extraction directory. Subsequent open or write operations performed on the extracted pathname will access the attacker chosen target, allowing arbitrary file read or overwrite on the host system.

The vulnerability affects the Perl Archive::Tar module distributed by the BINGOS vendor. All releases prior to 3.08 – for example 3.07 and earlier – are susceptible. Updating to version 3.08 or later removes the flaw.

The CVSS score of 9.1 highlights a critical severity, but the EPSS score of less than 1% suggests that exploitation attempts are unlikely to occur at this time. The issue is not listed in CISA’s KEV catalog. Exploitation requires an attacker to supply a malicious tar archive and trigger extraction; the impact is confined to the privileges under which the extraction process runs. If the process runs with elevated rights, the attacker can overwrite system files or read privileged data. In contexts where tar extraction is performed on untrusted inputs—such as in web applications or file import utilities—the risk becomes more pronounced if sufficient privileges exist.