Medium [CVE-2026-39243] File disclosure and corruption via arbitrary hardlink creation
This medium-severity Red Hat Linux advisory covers CVE-2026-39243 affecting Red Hat Hardened Images, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Build of Keycloak.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries (type === 'link'), the x.linkname field from the archive is passed directly to fs.link() without validation (index.js line 113).
An attacker can craft an archive with a hardlink entry whose linkname is an absolute path to any file on the same filesystem. This creates a hardlink inside the extraction directory that shares the same inode as the target file, enabling both reading and overwriting the original file's content.
Hardlinks are limited to files on the same filesystem and cannot target directories. A flaw was found in decompress.
An attacker can craft a malicious archive that, when extracted, allows for arbitrary hardlink creation. This could lead to sensitive file read disclosure or file corruption on the system.
This Moderate flaw in the `decompress` library allows an attacker to create arbitrary hardlinks during archive extraction. By crafting a malicious archive, an attacker could exploit this to disclose sensitive file contents or corrupt files on the same filesystem where the archive is extracted.
This risk is present in Red Hat products that utilize the `decompress` library for archive handling.
- < 4.2.2
Official advisory · high-confidence parse· fetched 13 days ago·verify at source
- dotnet8-0-main-8.0.128-1.1.hum1
- RHSA-2026:37577
Official advisory · high-confidence parse· fetched 13 days ago·verify at source
Mitigation checklist
- To mitigate this issue, avoid extracting archives from untrusted or unknown sources. When processing archives from potentially untrusted origins, consider using a sandboxed environment to limit the impact of any malicious content.
Official advisory · high-confidence parse· fetched 13 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.