CVE-2026-105712
âšī¸ lowSummary
gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.
CVSS Score
3.6
Low
EPSS Score
0.1
Exploit Probability
Published Date
2026-10-05
First Seen: 2026-10-08
đ Relative Risk Intelligence
This CVE is Lower Risk - more severe than 3.9% of all 365,616 vulnerabilities in our database.
#351,457
Below average severity
Severity Percentile
đ¯ CISA SSVC Assessment Updated: Oct 5, 2026
đ Exploitation Status
None
No known exploits
âī¸ Automatable
NO
Requires human interaction
đĨ Technical Impact
Partial
Limited system impact
SSVC data provided by
CISA
Last Modified
2026-10-06
Source
NVD đ
CVSS Vector 3.1
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
CWE IDs (Weakness Types)