A researcher crafted a tar archive using a single GNU tar invocation that extracts into 8 different ways depending on the extraction tool. The technique exploits ambiguous POSIX handling of hard links with pax headers containing size overrides, causing tools like bsdtar to produce different results than GNU tar, Python, Go, or Perl extractors.
Background
This demonstrates real-world exploitation of ambiguities in POSIX tar specifications, relevant to supply chain security and archive processing robustness across different toolchains.
- Source
- Lobsters
- Published
- Nov 10, 2026 at 09:47 PM
- Score
- 6.0 / 10