Path traversal in node-tar - CVE-2026-26960
Published: February 24, 2026
Vulnerability identifier: #VU123172
CSH Severity: Medium
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-26960
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences within the tar.extract() function when handling hardlinks inside archives. A remote user can pass a specially crafted archive to the application and read or write files to arbitrary locations on the system.
Affected software
node-tar
IBM Watson Discovery for IBM Cloud Pak for Data
Jira Service Management Data Center
Confluence Data Center
Siebel CRM End User
IBM QRadar Data Synchronization App
IBM Watson Discovery for IBM Cloud Pak for Data
Jira Service Management Data Center
Confluence Data Center
Siebel CRM End User
IBM QRadar Data Synchronization App
How to mitigate CVE-2026-26960
Install updates from vendor's website.
node-tar - update to 7.5.8
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.2
Jira Service Management Data Center - addressed in versions 10.3.18, 11.3.5
Confluence Data Center - addressed in versions 9.2.19, 10.2.10
IBM QRadar Data Synchronization App - update to 4.0.0
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.2
Jira Service Management Data Center - addressed in versions 10.3.18, 11.3.5
Confluence Data Center - addressed in versions 9.2.19, 10.2.10
IBM QRadar Data Synchronization App - update to 4.0.0