Is CVE-2026-42497 actively exploited?

No active exploitation of CVE-2026-42497 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-42497 be exploited remotely?

Yes. CVE-2026-42497 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-42497?

CVE-2026-42497 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2026-42497

HIGH

CVE-2026-42497

CWE-59Published: May 26, 2026· Updated: May 28, 2026

7.5

CVSS v3.1

EPSS:0.02%probability of exploitation in 30 daysPercentile:4.9th

Official Description

Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.

_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.

A subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.

NVD Source

Technical Analysis

CVE-2026-42497 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in full integrity compromise (data manipulation), with a CVSS base score of 7.5.