CVE-2013-4420: Multiple directory traversal vulnerabilities in the (1) tar_extract_glob and (2) tar_extract_all functions...

Security readout for executives and security teams

CVE-2013-4420 is a path traversal flaw in libtar. A malicious tar archive containing parent-directory paths could cause vulnerable extraction functions to write files outside the intended destination. Business impact depends on where libtar is used and the privileges of the extracting process. Exposure is most likely where libtar 1.2.20 or earlier extracts untrusted or remotely supplied tar files. Risk is higher for automated ingestion, upload processing, backup restore, or deployment workflows running with elevated filesystem permissions. Prioritize remediation for any internet-facing or automated workflow that extracts tar files from external sources. Systems only processing trusted internal archives are lower urgency, but should still be upgraded because arbitrary file overwrite can become serious when privileges are high. Mitigation focus: Identify software and services using libtar 1.2.20 or earlier.; Apply vendor or distribution updates, including Debian guidance where applicable.; Avoid extracting untrusted tar archives with vulnerable libtar versions..

Prepared

Jun 14, 2026, 14:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.