A flaw in the tar utility allows a remote attacker to craft an archive that injects hidden files with attacker‑controlled content during extraction, bypassing pre‑extraction inspection checks. The vulnerability is a classic instance of an unrestricted upload (CWE‑434), meaning the attacker can write arbitrary files to the filesystem, potentially leading to configuration compromise, privilege escalation, or subsequent code execution. The impact is that malicious files can appear undetected in a system after archive extraction.

Red Hat Enterprise Linux releases 6 through 10 and Red Hat Hardened Images contain the vulnerable tar implementation. All supported installations of tar on these platforms are affected; no specific version numbers are supplied in the advisory, but the flaw applies to the default tar shipped with these distributions.

The CVSS score of 5 indicates a moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not currently listed in the CISA KEV catalog, meaning no known exploit is actively in use. The attack vector is inferred to be via delivering a malicious archive to a system that extracts it, such as through a user‑initiated extraction or an automated process that unpacks archives without validating provenance. If exploited, the attacker could implant malicious files that later run or trigger automated workflows that process these files.