CVE-2026-18508

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.

• CWE-59

• https://access.redhat.com/errata/RHSA-2026:50807Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:61581
• https://access.redhat.com/errata/RHSA-2026:61586
• https://access.redhat.com/errata/RHSA-2026:61783
• https://access.redhat.com/errata/RHSA-2026:66018
• https://access.redhat.com/errata/RHSA-2026:70390
• https://access.redhat.com/security/cve/CVE-2026-18508Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2509843Issue Tracking, Vendor Advisory

Published

Aug 3, 2026

Last Modified

Sep 22, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-18500@fastify/jwt is a JSON Web Token plugin for Fastify. In vers…8.1
• CVE-2026-18501The UsersWP – Front-end login form, User Registration, User …6.4
• CVE-2026-18502Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-18503Attacker-controlled CSV samples can trigger super-linear re…2.4
• CVE-2026-18504fastify is a fast and low overhead web framework for Node.js…5.3
• CVE-2026-18505IBM Financial Transaction Manager (FTM) for RedHat OpenShift…5.4
• CVE-2026-18509IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticat…7.1
• CVE-2026-1851The iVysilani Shortcode plugin for WordPress is vulnerable t…6.4
• CVE-2026-18510The TranslatePress – Translate Multilingual sites with AI Tr…7.2
• CVE-2026-18511IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticat…7.8
• CVE-2026-18512The TranslatePress – Translate Multilingual sites with AI Tr…6.4
• CVE-2026-18515IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authentica…4.3