p PatchFirst

CVE-2026-105712

CVE-2026-105712

This page contains facts from public vulnerability sources. Check the original advisory before updating.

gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.

CVSS 3.6 · Low · EPSS 0.1% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • gnupg

    Versions
    • ≥ 0, < 2.5.19: Affected (semver)

    Update to 2.5.19

  • gnupg2 Debian:12

    Versions
    • 2.2.40-1.1
    • 2.2.40-1.1+deb12u1
    • 2.2.40-1.1+deb12u2
    • 2.2.40-1.1+hurd.1
    • 2.2.40-1.1+loong64
    • 2.2.40-2
    • 2.2.40-3
    • 2.2.43-1
    • 2.2.43-2
    • 2.2.43-3
    • 2.2.43-4
    • 2.2.43-5
    • 2.2.43-6
    • 2.2.43-7
    • 2.2.43-8
    • 2.2.44-1
    • 2.2.45-1
    • 2.2.45-2
    • 2.2.45-3
    • 2.2.46-1
    • 2.2.46-2
    • 2.2.46-3
    • 2.2.46-4
    • 2.2.46-5
    • 2.2.46-6
    • 2.2.46~pre1-1
    • 2.3.1-1
    • 2.4.3-2
    • 2.4.4-1
    • 2.4.4-2
    • 2.4.4-3
    • 2.4.4-4
    • 2.4.5-1
    • 2.4.5-2
    • 2.4.5-3
    • 2.4.6-1
    • 2.4.7-1
    • 2.4.7-10
    • 2.4.7-11
    • 2.4.7-12
    • 2.4.7-13
    • 2.4.7-14
    • 2.4.7-15
    • 2.4.7-16
    • 2.4.7-17
    • 2.4.7-18
    • 2.4.7-19
    • 2.4.7-2
    • 2.4.7-20
    • 2.4.7-21
    • 2.4.7-3
    • 2.4.7-4
    • 2.4.7-5
    • 2.4.7-6
    • 2.4.7-7
    • 2.4.7-8
    • 2.4.7-9
    • 2.4.8-1
    • 2.4.8-2
    • 2.4.8-3
    • 2.4.8-4
    • 2.4.8-5
    • 2.4.8-6
    • 2.4.9-1
    • 2.4.9-2
    • 2.4.9-3
    • 2.4.9-4
    • 2.4.9-5
    • 2.4.9-6
    • 2.4.9-7
    • 2.4.9-8
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • gnupg2 Debian:13

    Versions
    • 2.4.7-21
    • 2.4.7-21+deb13u1
    • 2.4.8-1
    • 2.4.8-2
    • 2.4.8-3
    • 2.4.8-4
    • 2.4.8-5
    • 2.4.8-6
    • 2.4.9-1
    • 2.4.9-2
    • 2.4.9-3
    • 2.4.9-4
    • 2.4.9-5
    • 2.4.9-6
    • 2.4.9-7
    • 2.4.9-8
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • gnupg2 Debian:14

    Versions
    • 2.4.7-21
    • 2.4.8-1
    • 2.4.8-2
    • 2.4.8-3
    • 2.4.8-4
    • 2.4.8-5
    • 2.4.8-6
    • 2.4.9-1
    • 2.4.9-2
    • 2.4.9-3
    • 2.4.9-4
    • 2.4.9-5
    • 2.4.9-6
    • 2.4.9-7
    Affected ranges
    • ECOSYSTEM: < 2.4.9-8

    Update to 2.4.9-8

  • gnupg2 Ubuntu:Pro:16.04:LTS

    Versions
    • 2.0.28-3ubuntu1
    • 2.0.28-3ubuntu2
    • 2.1.11-6ubuntu1
    • 2.1.11-6ubuntu2
    • 2.1.11-6ubuntu2.1
    • 2.1.11-6ubuntu2.1+esm1
    • 2.1.11-6ubuntu2.1+esm2
    • 2.1.11-6ubuntu2.1+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • gnupg2 Ubuntu:Pro:18.04:LTS

    Versions
    • 2.1.15-1ubuntu8
    • 2.2.4-1ubuntu1
    • 2.2.4-1ubuntu1.1
    • 2.2.4-1ubuntu1.2
    • 2.2.4-1ubuntu1.3
    • 2.2.4-1ubuntu1.4
    • 2.2.4-1ubuntu1.5
    • 2.2.4-1ubuntu1.6
    • 2.2.4-1ubuntu1.6+esm1
    • 2.2.4-1ubuntu1.6+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • gnupg2 Ubuntu:Pro:20.04:LTS

    Versions
    • 2.2.12-1ubuntu3
    • 2.2.17-3ubuntu1
    • 2.2.19-3ubuntu2
    • 2.2.19-3ubuntu2.1
    • 2.2.19-3ubuntu2.2
    • 2.2.19-3ubuntu2.4
    • 2.2.19-3ubuntu2.5
    • 2.2.19-3ubuntu2.5+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • gnupg2 Ubuntu:22.04:LTS

    Versions
    • 2.2.20-1ubuntu4
    • 2.2.27-2ubuntu1
    • 2.2.27-3ubuntu1
    • 2.2.27-3ubuntu2
    • 2.2.27-3ubuntu2.1
    • 2.2.27-3ubuntu2.3
    • 2.2.27-3ubuntu2.4
    • 2.2.27-3ubuntu2.5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • gnupg2 Ubuntu:24.04:LTS

    Versions
    • 2.2.40-1.1ubuntu1
    • 2.4.4-2ubuntu7
    • 2.4.4-2ubuntu15
    • 2.4.4-2ubuntu16
    • 2.4.4-2ubuntu17
    • 2.4.4-2ubuntu17.2
    • 2.4.4-2ubuntu17.3
    • 2.4.4-2ubuntu17.4
    • 2.4.4-2ubuntu17.6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • gnupg2 Ubuntu:26.10

    Versions
    • 2.4.8-4ubuntu3
    • 2.4.9-4ubuntu1
    • 2.4.9-4ubuntu2
    • 2.4.9-4ubuntu3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • gnupg2 Ubuntu:26.04:LTS

    Versions
    • 2.4.8-2ubuntu2
    • 2.4.8-4ubuntu1
    • 2.4.8-4ubuntu2
    • 2.4.8-4ubuntu3
    • 2.4.8-4ubuntu3.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →