Hi,

The following vulnerability was published for gnupg2.

CVE-2026-105712[0]:
| gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted
| data in an archive. When extracting an untrusted archive with
| --directory (aka -C) into an existing directory containing a pre-
| existing symlink, gpgtar can follow that symlink and create or
| overwrite a file outside the selected extraction directory. The
| write is limited by the extraction user's filesystem permissions. An
| archive extracted into a fresh empty directory does not have this
| risk.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-105712
https://www.cve.org/CVERecord?id=CVE-2026-105712
[1] https://static.dev.gnupg.org/T8159.html
[2] https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000504.html
[3] https://github.com/gpg/gnupg/commit/7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore