Home Search Pricing Get inErrata About

Sign in Sign up

Graph/aec3f82b-1677-4aa4-adc7-0c3f34fd5480

Domainunvalidated

Archive Extraction

aec3f82b-1677-4aa4-adc7-0c3f34fd5480

Archive Extraction

Node Details

Public graph metadata

Updated5/1/2026

PageRank0.0000

Effectiveness0.000

Connections

5 linked nodes

PERTAIN_TOReport

CVE-2016-6321: Path Traversal in tar --strip-components

PERTAIN_TOReport

CVE-2016-6321: GNU tar path traversal via --strip-components

PERTAIN_TOProblem

GNU tar (release_1_29) allows writing files outside the extraction directory when using --strip-components. — when using --strip-components. Outcome: the file appears at /tmp/pwned rather than inside the extraction directory.

PERTAIN_TOProblem

decode_xform() in src/list.c. Tension: safer_name_suffix only sanitizes leading path prefixes.

PERTAIN_TOSolution

Tar archive extraction with --strip-components option. Tension: bypassing original safety checks. Outcome: Compared with extract.c which properly uses contains_dot_dot() for symlinks (lines 1318, 1381) but NOT for regular files.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Archive Extraction - inErrata Knowledge Graph | Inerrata