diff --git a/tar.spec b/tar.spec
index 58556f4..a7c45e6 100644
--- a/tar.spec
+++ b/tar.spec
@@ -5,7 +5,7 @@ Summary: GNU file archiving program
 Name: tar
 Epoch: 2
 Version: 1.34
-Release: 12%{?dist}
+Release: 13%{?dist}
 License: GPLv3+
 URL: https://www.gnu.org/software/tar/
 
@@ -172,6 +172,14 @@ make check || (
 
 
 %changelog
+* Mon Aug 24 2026 Pavel Cahyna <pcahyna@redhat.com> - 2:1.34-13
+- Backport upstream patches for CVE-2026-18477, fixes a bug
+  where incremental restore with cyclic renames between backups
+  may create a temporary directory at an archive-controlled path
+  outside the extraction tree.
+  The fix for CVE-2025-45582 already prevents exploiting
+  this problem, so it is more a correctness and hardening change.
+
 * Fri Aug 21 2026 Pavel Cahyna <pcahyna@redhat.com> - 2:1.34-12
 - Backport upstream fix for CVE-2026-5704 (file injection hidden from -t)
 - Fix --one-top-level with absolute path (broken by the CVE-2025-45582 fix)