CVE-2022-26612

    Dashboard / Vulnerabilities / CVE-2022-26612

    CVE-2022-26612

    Published: 7 Apr 2022Last Modified: 12 Aug 2026

    Summary: Arbitrary file write in FileUtil#unpackEntries on Windows

    Details: In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes. As a result, a TAR entry may create a symlink under the expected extraction directory which points to an external directory. A subsequent TAR entry may extract an arbitrary file into the external directory using the symlink name. This however would be caught by the same targetDirPath check on Unix because of the getCanonicalPath call. However on Windows, getCanonicalPath doesn't resolve symbolic links, which bypasses the check. unpackEntries during TAR extraction follows symbolic links which allows writing outside expected base directory on Windows. This was addressed in Apache Hadoop 3.2.3

    References: https://lists.apache.org/thread/hslo7wzw2449gv1jyjk8g6ttd7935fyz, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/26xxx/CVE-2022-26612.json, https://nvd.nist.gov/vuln/detail/CVE-2022-26612, https://security.netapp.com/advisory/ntap-20220519-0004/

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -abe5358143720085498613d399be3bbf01e0f131

    Affected versions

    3.3.1-NA
    3.3.2-NA

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-26612 | CVE-DB