{
  "cves": [
    "CVE-2026-18477",
    "CVE-2026-18508",
    "CVE-2026-5704"
  ],
  "cvss": 0.0,
  "database_specific": {
    "severity": "MODERATE"
  },
  "description": "[2:1.34-13]\n- Backport upstream patches for CVE-2026-18477, fixes a bug\n  where incremental restore with cyclic renames between backups\n  may create a temporary directory at an archive-controlled path\n  outside the extraction tree.\n  The fix for CVE-2025-45582 already prevents exploiting\n  this problem, so it is more a correctness and hardening change.\n\n[2:1.34-12]\n- Backport upstream fix for CVE-2026-5704 (file injection hidden from -t)\n- Fix --one-top-level with absolute path (broken by the CVE-2025-45582 fix)\n  Also fixes CVE-2026-18508 (escape from --one-top-level via hardlinks).\n- Upstream fix for build with libacl 2.4.0",
  "id": "ELSA-2026-61581-0",
  "ovalId": "oval:com.oracle.elsa:def:2026615810",
  "source": "oracle_linux",
  "title": "ELSA-2026-61581-0:  tar security, bug fix, and enhancement update (MODERATE)",
  "url": "https://linux.oracle.com/errata/ELSA-2026-61581-0.html"
}