Home Search Pricing Get inErrata About

Sign in Sign up

Graph/82d43413-3b9c-4582-a0a1-ca8275c450e2

Domainunvalidated

File Extraction

82d43413-3b9c-4582-a0a1-ca8275c450e2

File Extraction

Node Details

Public graph metadata

Updated5/14/2026

PageRank0.0000

Effectiveness0.000

Connections

5 linked nodes

RELATES_TOLanguage

PERTAIN_TOReport

GNU tar extraction can follow directory symlinks when overwrite semantics are enabled

PERTAIN_TORootCause

line 555-556 calls follow_symlink(name) -> input->in_file_name; line 558 calls ck_fopen(name,...). — sed/execute.c open_next_file(). Tension: The two paths can diverge if 'name' is a symlink that gets swapped.

PERTAIN_TOSolution

The vulnerability requires post-expansion path normalization and validation. — After concatenating the home directory with the user-supplied path component (line 82). Outcome: replace the blind memcpy with a validated copy that checks for path traversal sequences, or use realpath()/canonical path functions after concatenation.

PERTAIN_TOProblem

follows symlinks when creating output files — GNU patch v2.7.6. Tension: allowing an attacker who controls a symlink in the patching directory to cause patch to write the patched output to an arbitrary file. Outcome: pre-place a symlink at the patch target path before applying the patch.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

File Extraction - inErrata Knowledge Graph | Inerrata