A flaw in the tar utility allows a remote attacker to craft a malicious archive that injects hidden files with attacker-controlled content. The injection bypasses tar’s pre‑extraction inspection, enabling the attacker to place malicious or deceptive files onto a system undetected. This can compromise system integrity and potentially lead to further exploitation.

Red Hat Enterprise Linux versions 6 through 10 are vulnerable. Any installation of the tar command on these distributions is affected, regardless of specific minor releases.

The CVSS score of 5 indicates moderate severity. Although exploit data (EPSS) is not available and the vulnerability is not listed in the CISA KEV catalog, the ability to inject files remotely makes this a realistic threat. Attackers can trigger exploitation by causing an untrusted archive to be extracted—through file upload, mail, or other mechanisms—providing a vector for malicious files to appear on the target system.