What is CVE-2026-105712?

CVE-2026-105712 is a low-severity vulnerability in Gnupg, classified under UNIX Symbolic Link (Symlink) Following. CVSS score: 3.6/10. Published 2026-10-05.

How severe is CVE-2026-105712?

Low severity. CVSS v3 base score is 3.6 out of 10.

Vulnerability in Gnupg

CVE-2026-105712

gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.

Published 2026-10-05 · last modified 2026-10-06.

CVSS v3 metric

CVSS v3 base score 3.6 (Low). Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Gnupg

Weakness classification (CWE)

CWE-61 — UNIX Symbolic Link (Symlink) Following

References

Frequently asked questions

What is CVE-2026-105712?: CVE-2026-105712 is a low-severity vulnerability in Gnupg, classified under UNIX Symbolic Link (Symlink) Following. CVSS score: 3.6/10. Published 2026-10-05.
How severe is CVE-2026-105712?: Low severity. CVSS v3 base score is 3.6 out of 10.