An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of the archive. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. A local attacker may use this flaw to gain more privileges in a system.
CVE-2021-31566
CVSS base score
7.8 (v3.1)
Severity
HIGH
Attack vector
Local
Weakness
CWE-59
Last modified
November 2, 2026
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
libarchive libarchive
fedoraproject fedora
redhat enterprise linux
redhat enterprise linux eus
redhat enterprise linux for ibm z systems
redhat enterprise linux for ibm z systems eus
redhat enterprise linux for power little endian
redhat enterprise linux for power little endian eus
redhat enterprise linux server aus
redhat enterprise linux server for power little endian update services for sap solutions
References
- access.redhat.com Third Party Advisory
- bugzilla.redhat.com Issue Tracking, Patch, Third Party Advisory
- github.com Patch, Third Party Advisory
- github.com Issue Tracking, Patch, Third Party Advisory
- lists.debian.org Mailing List, Third Party Advisory
- access.redhat.com Third Party Advisory
- bugzilla.redhat.com Issue Tracking, Patch, Third Party Advisory
- github.com Patch, Third Party Advisory
- github.com Issue Tracking, Patch, Third Party Advisory
- lists.debian.org Mailing List, Third Party Advisory