CVE-2026-105712: Gnupg

Low severity, CVSS 3.6. EPSS: 0.1% chance of exploitation in the next 30 days.

gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.

Affected products

• Gnupg Gnupg: before 2.5.19 (fixed in 2.5.19)

Published 2026-10-05. Last modified 2026-10-06.