The Archive::Tar module fails to validate the linkname field of tar headers when creating hardlinks. As a result, an attacker can supply a tar archive that contains hardlink entries pointing to absolute paths or directories outside the intended extraction directory. The module then creates a hardlink to the target file and later writes to it during extraction, thereby overwriting or modifying files the attacker should not be able to touch. This flaw allows arbitrary file creation or modification on the victim’s system and, if the process runs with elevated privileges, can lead to privilege escalation. The weakness is a form of path traversal (CWE‑59) combined with improper permissions handling (CWE‑732).

All versions of the Perl Archive::Tar module from the BINGOS vendor older than 3.08 are affected. The issue was fixed in the 3.08 release and later.

Because the vulnerability is triggered by supplying a malicious tar file, the attack vector is local extraction by any user who can influence the file fed to Archive::Tar, or remote if the application accepts input from untrusted networks. Exploitation requires the target process to run with write access to the filesystem area targeted by the hardlink. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Despite the lack of a known active exploit, its high impact and the ability to overwrite arbitrary files make it a serious risk, particularly in environments where the extraction routine is executed with elevated privileges.