CVE-2026-105712

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-105712
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105712.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-105712
Downstream
AZL (1)
BELL (1)
CLSA (1)
DEBIAN (1)
ECHO (1)
OESA (4)
RHSA (1)
UBUNTU (1)
Published
2026-10-05T18:53:09Z
Modified
2026-10-21T09:32:28Z
Severity
  • 3.6 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L CVSS Calculator
Summary
[none]
Details

gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.

Database specific 
{
    "cna_assigner":  "mitre",
    "cwe_ids":  [
        "CWE-61"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105712.json"
}
References

Affected packages

Git / github.com/gpg/gnupg

Affected ranges

Type
GIT
Repo
https://github.com/gpg/gnupg
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b0750c06a39adebcaa0d4f250156c3d3238545d9
Fixed
7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "2.5.19"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

Other
ABANDONED-V-1-2-0
NEWPG-0-0-0
NEWPG-0-3-0
NEWPG-0-3-1
NEWPG-0-3-10
NEWPG-0-3-2
NEWPG-0-3-3
NEWPG-0-3-4
NEWPG-0-3-5
NEWPG-0-3-6
NEWPG-0-3-7
NEWPG-0-3-8
NEWPG-0-3-9
NEWPG-0-9-0
NEWPG-0-9-1
NEWPG-0-9-2
RC-1-2-1rc1
RC-1-2-2rc1
RC-1-2-2rc2
RC-1-2-3rc1
RC-1-2-3rc2
RC-1-2-4rc1
RC-1-2-5rc1
RC-1-2-5rc2
RC-1-4-1rc1
RC-1-4-1rc2
RC-1-4-2rc1
RC-1-4-2rc2
V-0-2-8
V0-0-0
V0-1-0
V0-2-0
V0-2-10
V0-2-15
V0-2-17
V0-2-18
V0-2-19
V0-2-6
V0-3-0
V0-3-1
V0-3-2
V0-3-3
V0-3-4
V0-3-5
V0-4-0
V0-4-1
V0-4-2
V0-4-3
V0-4-4
V0-4-5
V0-9-0
V0-9-1
V0-9-10
V0-9-11
V0-9-2
V0-9-3
V0-9-4
V0-9-5
V0-9-6
V0-9-7
V0-9-8
V0-9-9
V1-0-0
V1-0-1
V1-0-1-ePit-1
V1-0-2
V1-0-3
V1-0-4
V1-1-0
V1-1-2
V1-1-90
V1-1-91
V1-1-92
V1-2-0
V1-2-1
V1-2-2
V1-2-3
V1-2-4
V1-2-5
V1-3-0
V1-3-1
V1-3-2
V1-3-3
V1-3-4
V1-3-5
V1-3-6
V1-3-90
V1-3-91
V1-3-92
V1-3-93
V1-4-0
V1-4-1
V1-9-0
ecc-integration-done
post-nuke-of-trailing-ws
Beta-2.*
Beta-2.3.0-beta1598
Beta-2.3.0-beta1655
gnupg-1.*
gnupg-1.4.3
gnupg-1.4.3rc1
gnupg-1.4.3rc2
gnupg-1.4.4
gnupg-1.4.5
gnupg-1.4.5rc1
gnupg-1.9.23
gnupg-1.9.90
gnupg-1.9.91
gnupg-1.9.92
gnupg-1.9.93
gnupg-1.9.94
gnupg-1.9.95
gnupg-2.*
gnupg-2.0.1
gnupg-2.0.10
gnupg-2.0.10rc1
gnupg-2.0.11
gnupg-2.0.12
gnupg-2.0.13
gnupg-2.0.1rc1
gnupg-2.0.2
gnupg-2.0.3
gnupg-2.0.4
gnupg-2.0.5
gnupg-2.0.6
gnupg-2.0.7
gnupg-2.0.8
gnupg-2.0.8rc1
gnupg-2.0.9
gnupg-2.1-base
gnupg-2.1.0
gnupg-2.1.0-beta442
gnupg-2.1.0-beta751
gnupg-2.1.0-beta783
gnupg-2.1.0-beta834
gnupg-2.1.0-beta864
gnupg-2.1.0-beta895
gnupg-2.1.0beta1
gnupg-2.1.0beta2
gnupg-2.1.0beta3
gnupg-2.1.1
gnupg-2.1.11
gnupg-2.1.12
gnupg-2.1.13
gnupg-2.1.14
gnupg-2.1.15
gnupg-2.1.16
gnupg-2.1.17
gnupg-2.1.18
gnupg-2.1.19
gnupg-2.1.2
gnupg-2.1.20
gnupg-2.1.21
gnupg-2.1.22
gnupg-2.1.23
gnupg-2.1.3
gnupg-2.1.4
gnupg-2.1.5
gnupg-2.1.6
gnupg-2.1.7
gnupg-2.1.8
gnupg-2.1.9
gnupg-2.2-base
gnupg-2.2.0
gnupg-2.3-base
gnupg-2.3.0
gnupg-2.3.1
gnupg-2.3.2
gnupg-2.3.3
gnupg-2.3.4
gnupg-2.3.5
gnupg-2.3.6
gnupg-2.3.7
gnupg-2.3.8
gnupg-2.4-base
gnupg-2.4.0
gnupg-2.4.1
gnupg-2.5-base
gnupg-2.5.0
gnupg-2.5.1
gnupg-2.5.10
gnupg-2.5.11
gnupg-2.5.12
gnupg-2.5.13
gnupg-2.5.14
gnupg-2.5.15
gnupg-2.5.16
gnupg-2.5.17
gnupg-2.5.18
gnupg-2.5.2
gnupg-2.5.3
gnupg-2.5.4
gnupg-2.5.5
gnupg-2.5.6
gnupg-2.5.7
gnupg-2.5.8
gnupg-2.5.9
gnupg-2.6-base

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105712.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "13097378224317258864026974269477030122",
                "158729894522543271203206778134314103178",
                "88122209046503000679338184289603110899",
                "200032024314597089218689236325263696025",
                "197299948198612072136240397343174861009",
                "130920609504032014851849244093627190478",
                "120406065900572489185145255309584807091",
                "305249205340883751789101281741937356309",
                "130555803130274344735821906850445039987",
                "323833104658801524360339416309592770937",
                "45805380101387048693623207667792386098"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-105712-b15f75ba",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/gpg/gnupg/commit/7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88",
        "target":  {
            "file":  "tools/gpgtar-extract.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "39632332777750812516549727247968109080",
            "length":  4624
        },
        "id":  "CVE-2026-105712-dc655939",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/gpg/gnupg/commit/7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88",
        "target":  {
            "file":  "tools/gpgtar-extract.c",
            "function":  "gpgtar_extract"
        }
    }
]
vanir_signatures_modified 
"2026-10-21T09:32:28Z"