node-tar v<7.5.10 Hardlink Exploit via C:../ Target Path Traversal
CVE-2026-29786 Published on March 7, 2026

node-tar: Hardlink Path Traversal via Drive-Relative Linkpath
node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This issue has been patched in version 7.5.10.

NVD

Vulnerability Analysis

CVE-2026-29786 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. Public availability of a proof of concept (POC) exploit exists for CVE-2026-29786. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, a high impact on integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
CHANGED
Confidentiality Impact:
NONE
Integrity Impact:
HIGH
Availability Impact:
NONE

Weakness Types

What is a Directory traversal Vulnerability?

The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

CVE-2026-29786 has been classified to as a Directory traversal vulnerability or weakness.

What is an insecure temporary file Vulnerability?

The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

CVE-2026-29786 has been classified to as an insecure temporary file vulnerability or weakness.


Products Associated with CVE-2026-29786

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Cryostat
 
Red Hat Logging
 
Red Hat Network Observ Optr
 
Red Hat 3scale Amp
 
Red Hat Acm
 
Red Hat Amq Broker
 
Red Hat Apache Camel Hawtio
 
Red Hat Enterprise Linux (RHEL)
 
Red Hat Jboss Fuse
 
Red Hat Jboss Enterprise Application Platform
 
Red Hat Jbosseapxp
 
Red Hat Openshift Ai
 
Red Hat Openshift
 
Red Hat Openshift Data Foundation
 
Red Hat Openshift Devspaces
 
Red Hat Jboss Enterprise Bpms Platform
 
Red Hat Single Sign On
 
Red Hat Trusted Artifact Signer
 

Affected Versions

isaacs node-tar: Red Hat Cryostat 4: Logging Subsystem for Red Hat OpenShift: Logging Subsystem for Red Hat OpenShift: Logging Subsystem for Red Hat OpenShift: Logging Subsystem for Red Hat OpenShift: Logging Subsystem for Red Hat OpenShift: Logging Subsystem for Red Hat OpenShift: Red Hat Network Observability Operator: Red Hat Network Observability Operator: Red Hat 3scale API Management Platform 2: Red Hat 3scale API Management Platform 2: Red Hat 3scale API Management Platform 2: Red Hat 3scale API Management Platform 2: Red Hat 3scale API Management Platform 2: Red Hat 3scale API Management Platform 2: Red Hat 3scale API Management Platform 2: Red Hat 3scale API Management Platform 2: Red Hat 3scale API Management Platform 2: Red Hat Advanced Cluster Management for Kubernetes 2: Red Hat Advanced Cluster Management for Kubernetes 2: Red Hat Advanced Cluster Management for Kubernetes 2: Red Hat AMQ Broker 7: Red Hat build of Apache Camel - HawtIO 4: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Fuse 7: Red Hat Fuse 7: Red Hat Fuse 7: Red Hat Fuse 7: Red Hat JBoss Enterprise Application Platform 7: Red Hat JBoss Enterprise Application Platform 7: Red Hat JBoss Enterprise Application Platform 8: Red Hat JBoss Enterprise Application Platform 8: Red Hat JBoss Enterprise Application Platform Expansion Pack: Red Hat JBoss Enterprise Application Platform Expansion Pack: Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat Openshift Data Foundation 4: Red Hat Openshift Data Foundation 4: Red Hat Openshift Data Foundation 4: Red Hat Openshift Data Foundation 4: Red Hat OpenShift Dev Spaces: Red Hat OpenShift Dev Spaces: Red Hat OpenShift Dev Spaces: Red Hat OpenShift Dev Spaces: Red Hat Process Automation 7: Red Hat Process Automation 7: Red Hat Single Sign-On 7: Red Hat Trusted Artifact Signer:

Exploit Probability

EPSS
0.28%
Percentile
19.09%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.