CVE-2015-8860
Symlink Arbitrary File Overwrite in tar
The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive.
- Record
CVE-2015-8860- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-59
- Updated
- 2026-11-02
CVE List No score
The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive.
- Record
CVE-2015-8860- Updated
- 2026-11-02
EUVDEUVD-2017-0237 No score
The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive.
- Record
EUVD-2017-0237- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gfjr-3jmm-4g9v
Symlink Arbitrary File Overwrite in tar
Versions of tar prior to 2.0.0 are affected by an arbitrary file write vulnerability. The vulnerability occurs because tar does not verify that extracted symbolic links to not resolve to targets outside of the extraction root directory.
Recommendation
Update to version 2.0.0 or later
- Record
GHSA-gfjr-3jmm-4g9v- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-59
- Updated
- 2026-11-02
OSV
The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive.
- Record
CVE-2015-8860- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-8860
The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive.
- Record
DEBIAN-CVE-2015-8860- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSVGHSA-gfjr-3jmm-4g9v
Symlink Arbitrary File Overwrite in tar
Versions of tar prior to 2.0.0 are affected by an arbitrary file write vulnerability. The vulnerability occurs because tar does not verify that extracted symbolic links to not resolve to targets outside of the extraction root directory.
Recommendation
Update to version 2.0.0 or later
- Record
GHSA-gfjr-3jmm-4g9v- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-59
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-8860
The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive.
- Record
UBUNTU-CVE-2015-8860- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1773620217 No score
TuxCare security update for tar (4 CVEs)
TuxCare rebuilt tar to address 4 CVEs. Fixed in 1.0.3-tuxcare.1.
- Record
CLSA-2026-1773620217- Updated
- 2026-11-02
OSVCLSA-2026-1774484514 No score
TuxCare security update for tar (5 CVEs)
TuxCare rebuilt tar to address 5 CVEs. Fixed in 2.1.1-tuxcare.1.
- Record
CLSA-2026-1774484514- Updated
- 2026-11-02
OSVUSN-4777-1 No score
node-tar vulnerability
It was discovered that node-tar mishandled certain tar archives. An attacker could use this vulnerability to write arbitrary files to the filesystem.
- Record
USN-4777-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tarnpm |
before 2.0.0 | 2.0.0 |
tarTuxCare:npm From an advisory covering 4 CVEs |
1.0.3-tuxcare.0 up to 1.0.3-tuxcare.1, plus listed versions 1.0.3 |
1.0.3-tuxcare.1 |
tarTuxCare:npm From an advisory covering 5 CVEs |
2.1.1-tuxcare.0 up to 2.1.1-tuxcare.1, plus listed versions 2.1.1 |
2.1.1-tuxcare.1 |
node-tarDebian:12 |
before 2.2.1-1 | 2.2.1-1 |
node-tarDebian:13 |
before 2.2.1-1 | 2.2.1-1 |
node-tarDebian:14 |
before 2.2.1-1 | 2.2.1-1 |
node-tarUbuntu:Pro:14.04:LTS |
before 0.1.18-1ubuntu0.1~esm1, plus listed versions 0.1.18-1 |
0.1.18-1ubuntu0.1~esm1 |
node-tarUbuntu:Pro:16.04:LTS |
before 1.0.3-2ubuntu0.1~esm1, plus listed versions 1.0.3-2 |
1.0.3-2ubuntu0.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-8860 is a high vulnerability (CVSS 7.5) in Nodejs Node.js, published January 23, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.00%, the 90th percentile. Fixed in tar 2.0.0.