CVE-2026-18477
Awaiting Analysis Awaiting Analysis - Queue

TOCTOU Race Condition in GNU tar Incremental Dumpdir Handling

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: Red Hat, Inc.

Description
A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-18477
EUVD
EUVD-2026-52336

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gnu tar *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-367 The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling. A local attacker with write access to a directory being backed up can influence the restore process on another system. During restoration, files or directories may be created, renamed, or overwritten outside the intended extraction directory, potentially leading to unauthorized file modification or privilege escalation.

Detection Guidance

This vulnerability is specific to GNU tar's incremental dumpdir 'X' rename handling. Detection requires checking if GNU tar is installed and verifying if the version is vulnerable. Use 'tar --version' to check the installed version. If the version is affected, monitor file system changes during tar operations, especially during restores.

Impact Analysis

If you use GNU tar for backups and restores, an attacker with local access could manipulate the restore process to modify or overwrite files outside the intended directory. This could lead to unauthorized changes to system files, data corruption, or privilege escalation if critical system files are affected.

Compliance Impact

This vulnerability could compromise data integrity and confidentiality by allowing unauthorized file modifications. For GDPR, it may lead to unauthorized access or processing of personal data. For HIPAA, it could result in unauthorized changes to protected health information, violating compliance requirements.

Mitigation Strategies

Immediately update GNU tar to the latest patched version. Avoid using incremental dumpdir features or restrict write access to directories involved in backup/restore operations. Review and restrict user permissions to minimize potential impact.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18477. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart