---
id: CVE-2026-18477
title: >-
  A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental
  dumpdir 'X' rename handling allows a local attacker with write access to a
  directory being backed up to influence the restore process if the attacker has
  access …
summary: >-
  A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental
  dumpdir 'X' rename handling allows a local attacker with write access to a
  directory being backed up to influence the restore process if the attacker has
  access …
severity: medium
cvss: 4.4
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N'
cwe:
  - CWE-367
vendor: gnu
product: tar
affected:
  - tar = 1.35
  - openshift_container_platform = 4.0
  - enterprise_linux = 8.0
  - enterprise_linux = 9.0
  - enterprise_linux = 10.0
published: '2026-08-03'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T18:17:56.970'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-18477'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2026:49361'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:61581'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:61586'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:61783'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:66018'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/security/cve/CVE-2026-18477'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2509735'
    label: secalert@redhat.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-08-03T16:25:22.002230Z'
ingestedAt: '2026-09-14T04:15:09.011Z'
epss: 0.0008
epssPercentile: 0.00208
---

## Overview

A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue.

## Affected

- `tar = 1.35`
- `openshift_container_platform = 4.0`
- `enterprise_linux = 8.0`
- `enterprise_linux = 9.0`
- `enterprise_linux = 10.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.