{"id":"CVE-2026-105712","details":"gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.","modified":"2026-10-06T10:45:49.742627645Z","published":"2026-10-05T18:53:09.873Z","database_specific":{"cna_assigner":"mitre","cwe_ids":["CWE-61"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105712.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105712.json"},{"type":"FIX","url":"https://github.com/gpg/gnupg/commit/7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88"},{"type":"WEB","url":"https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000504.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105712"},{"type":"WEB","url":"https://static.dev.gnupg.org/T8159.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/gpg/gnupg","events":[{"introduced":"0"},{"fixed":"b0750c06a39adebcaa0d4f250156c3d3238545d9"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.5.19"}],"source":"AFFECTED_FIELD"}}],"versions":["gnupg-2.5.18","gnupg-2.5.17","gnupg-2.5.16","gnupg-2.5.15","gnupg-2.5.14","gnupg-2.5.13","gnupg-2.5.12","gnupg-2.5.11","gnupg-2.5.10","gnupg-2.5.9","gnupg-2.5.8","gnupg-2.5.7","gnupg-2.5.6","gnupg-2.5.5","gnupg-2.5.4","gnupg-2.5.3","gnupg-2.5.2","gnupg-2.5.1","gnupg-2.5.0","gnupg-2.6-base","gnupg-2.5-base","gnupg-2.4.1","gnupg-2.4.0","gnupg-2.3.8","gnupg-2.3.7","gnupg-2.3.6","gnupg-2.3.5","gnupg-2.3.4","gnupg-2.3.3","gnupg-2.3.2","gnupg-2.3.1","gnupg-2.3.0","Beta-2.3.0-beta1655","Beta-2.3.0-beta1598","gnupg-2.4-base","gnupg-2.3-base","gnupg-2.2.0","gnupg-2.2-base","gnupg-2.1.23","gnupg-2.1.22","gnupg-2.1.21","gnupg-2.1.20","gnupg-2.1.19","gnupg-2.1.18","gnupg-2.1.17","gnupg-2.1.16","gnupg-2.1.15","gnupg-2.1.14","gnupg-2.1.13","gnupg-2.1.12","gnupg-2.1.11","gnupg-2.1.9","gnupg-2.1.8","gnupg-2.1.7","gnupg-2.1.6","gnupg-2.1.5","gnupg-2.1.4","gnupg-2.1.3","gnupg-2.1.2","gnupg-2.1.1","gnupg-2.1.0","gnupg-2.1.0-beta895","gnupg-2.1.0-beta864","gnupg-2.1.0-beta834","gnupg-2.1.0-beta783","gnupg-2.1.0-beta751","gnupg-2.1.0-beta442","gnupg-2.1.0beta3","gnupg-2.1.0beta2","post-nuke-of-trailing-ws","ecc-integration-done","gnupg-2.1.0beta1","gnupg-2.1-base","gnupg-2.0.13","gnupg-2.0.12","gnupg-2.0.11","gnupg-2.0.10","gnupg-2.0.10rc1","gnupg-2.0.9","gnupg-2.0.8","gnupg-2.0.8rc1","gnupg-2.0.7","gnupg-2.0.6","gnupg-2.0.5","gnupg-2.0.4","gnupg-2.0.3","gnupg-2.0.2","gnupg-2.0.1","gnupg-2.0.1rc1","gnupg-1.9.95","gnupg-1.9.94","gnupg-1.9.93","gnupg-1.9.92","gnupg-1.9.91","gnupg-1.9.90","gnupg-1.9.23","gnupg-1.4.5","gnupg-1.4.5rc1","gnupg-1.4.4","gnupg-1.4.3","gnupg-1.4.3rc2","gnupg-1.4.3rc1","RC-1-4-2rc2","RC-1-4-2rc1","V1-4-1","RC-1-4-1rc2","RC-1-4-1rc1","V1-4-0","V1-3-93","V1-3-92","V1-3-91","V1-3-90","V1-3-6","V1-3-5","V1-3-4","V1-3-3","V1-9-0","V1-3-2","V1-3-1","V1-3-0","NEWPG-0-9-2","V1-2-1","V1-2-0","RC-1-2-2rc2","RC-1-2-2rc1","RC-1-2-1rc1","V1-1-92","V1-2-2","V1-2-5","V1-2-4","V1-2-3","RC-1-2-5rc2","RC-1-2-5rc1","RC-1-2-4rc1","RC-1-2-3rc2","RC-1-2-3rc1","NEWPG-0-9-1","NEWPG-0-9-0","NEWPG-0-3-10","V1-1-91","NEWPG-0-3-9","V1-1-90","NEWPG-0-3-8","NEWPG-0-3-7","NEWPG-0-3-6","NEWPG-0-3-5","NEWPG-0-3-4","NEWPG-0-3-3","NEWPG-0-3-2","NEWPG-0-3-1","NEWPG-0-3-0","NEWPG-0-0-0","ABANDONED-V-1-2-0","V1-1-2","V1-0-4","V1-0-3","V1-0-2","V1-0-1-ePit-1","V1-1-0","V1-0-1","V1-0-0","V0-9-11","V0-9-10","V0-9-9","V0-9-8","V0-9-7","V0-9-6","V0-9-5","V0-9-4","V0-9-3","V0-9-2","V0-9-1","V0-9-0","V0-4-5","V0-4-4","V0-4-3","V0-4-2","V0-4-1","V0-4-0","V0-3-5","V0-3-4","V0-3-3","V0-3-2","V0-3-1","V0-3-0","V0-2-19","V0-2-18","V0-2-17","V0-2-15","V0-2-10","V-0-2-8","V0-2-6","V0-2-0","V0-1-0","V0-0-0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105712.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L"}]}