CVE-2007-4131: GNU Tar

Medium severity, CVSS 6.8. EPSS: 2.7% chance of exploitation in the next 30 days.

Directory traversal vulnerability in the contains_dot_dot function in src/names.c in GNU tar allows user-assisted remote attackers to overwrite arbitrary files via certain //.. (slash slash dot dot) sequences in directory symlinks in a TAR archive.

Affected products

• GNU Tar: version 1.13 only; version 1.13.5 only; version 1.13.11 only; version 1.13.14 only; version 1.13.16 only; version 1.13.17 only; …

Published 2007-08-25. Last modified 2026-06-16.