{"id":"CVE-2024-12905","aliases":["AZL-59367","CLSA-2026-1774484497","CLSA-2026-1788560472","CLSA-2026-1790963499","DEBIAN-CVE-2024-12905","DLA-4214-1","EUVD-2024-54315","GHSA-pq67-2wwv-3xjx","MGASA-2025-0194","ROOT-APP-NPM-CVE-2024-12905","UBUNTU-CVE-2024-12905","USN-8367-1","fix-test-env-compat"],"status":"published","title":"tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File","description":"An Improper Link Resolution Before File Access (\"Link Following\") and Improper Limitation of a Pathname to a Restricted Directory (\"Path Traversal\"). This vulnerability occurs when extracting a maliciously crafted tar file, which can result in unauthorized file writes or overwrites outside the intended extraction directory. The issue is associated with index.js in the tar-fs package.\n\nThis issue affects tar-fs: from 0.0.0 before 1.16.4, from 2.0.0 before 2.1.2, from 3.0.0 before 3.0.8.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.02299,"percentile":0.8342,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-22","CWE-59"],"published":"2025-03-27T16:25:34Z","modified":"2026-11-06T13:15:18Z","exploits":[{"source":"exploitdb","id":"EDB-52268","title":"tar-fs 3.0.0 - Arbitrary File Write/Overwrite","type":"local","platform":"linux","date":"2025-04-22","url":"https://www.exploit-db.com/exploits/52268"},{"source":"pocgithub","id":"theMcSam/CVE-2024-12905-PoC","title":"theMcSam/CVE-2024-12905-PoC","date":"2025-04-24","url":"https://github.com/theMcSam/CVE-2024-12905-PoC"}],"fixes":[{"ecosystem":"npm","package":"tar-fs","fixed_in":["1.16.4","2.1.2","3.0.7"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:2","package":"reaper","fixed_in":["3.1.1-18"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-tar-fs","fixed_in":["2.1.3-0+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-tar-fs","fixed_in":["3.0.8+~cs2.0.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-tar-fs","fixed_in":["3.0.8+~cs2.0.4-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"tar-fs","fixed_in":["3.0.6-aikido.2","2.0.0-aikido.4","1.16.3-aikido.1","2.1.2-aikido.1","2.1.2-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/tar-fs","fixed_in":["3.0.6-root.io.1","2.0.0-root.io.1","2.0.0-root.io.2","2.0.0-root.io.3","2.0.0-root.io.4","3.0.6-root.io.2","1.16.3-root.io.1","2.1.2-root.io.1","2.1.2-root.io.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-tar-fs","fixed_in":["2.1.1-6ubuntu0.22.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"node-tar-fs","fixed_in":["2.1.1-6ubuntu0.24.04.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.4"}]}]},{"source":"ghsa","ecosystem":"npm","package":"tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.1.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.7"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"reaper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-18"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.1-tuxcare.0"},{"fixed":"1.5.1-tuxcare.1"}]}],"versions":["1.5.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.4-tuxcare.0"},{"fixed":"3.0.4-tuxcare.1"}]}],"versions":["3.0.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.1-tuxcare.0"},{"fixed":"2.1.1-tuxcare.1"}]}],"versions":["2.1.1"],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"node-tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-0+deb12u1"}]}],"versions":["2.1.1-6"]},{"source":"osv","ecosystem":"Debian:13","package":"node-tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8+~cs2.0.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8+~cs2.0.4-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"node-tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-0+deb11u1"}]}],"versions":["2.1.1-2","2.1.1-3","2.1.1-4","2.1.1-6"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"tar-fs","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.16.4"}]}]},{"source":"osv","ecosystem":"npm","package":"tar-fs","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.1.2"}]}]},{"source":"osv","ecosystem":"npm","package":"tar-fs","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.0.7"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"yarnpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.22-0.10.9.2.1.mga9"}]}],"bundled":11},{"source":"osv","ecosystem":"Root:npm","package":"tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-aikido.2"},{"fixed":"2.0.0-aikido.4"},{"fixed":"1.16.3-aikido.1"},{"fixed":"2.1.2-aikido.1"},{"fixed":"2.1.2-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-root.io.1"},{"fixed":"2.0.0-root.io.1"},{"fixed":"2.0.0-root.io.2"},{"fixed":"2.0.0-root.io.3"},{"fixed":"2.0.0-root.io.4"},{"fixed":"3.0.6-root.io.2"},{"fixed":"1.16.3-root.io.1"},{"fixed":"2.1.2-root.io.1"},{"fixed":"2.1.2-root.io.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-6ubuntu0.22.04.1~esm1"}]}],"versions":["2.1.1-2","2.1.1-4","2.1.1-6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"node-tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-6ubuntu0.24.04.1~esm1"}]}],"versions":["2.1.1-6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-6ubuntu0.22.04.1~esm1"}]}],"versions":["2.1.1-2","2.1.1-4","2.1.1-6"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"node-tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-6ubuntu0.24.04.1~esm1"}]}],"versions":["2.1.1-6"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9+~cs2.0.4-1+deb13u1build0.25.10.1"}]}],"versions":["2.1.1-6","3.0.8+~cs2.0.4-1","3.0.9+~cs2.0.4-1"],"bundled":3}],"references":[{"url":"https://github.com/mafintosh/tar-fs/commit/a1dd7e7c7f4b4a8bd2ab60f513baca573b44e2ed","tags":["patch","fix","web","report"]},{"url":"https://www.seal.security/blog/a-link-to-the-past-uncovering-a-new-vulnerability-in-tar-fs","tags":["technical-description","article","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/06/msg00012.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-12905","tags":["web","advisory"]},{"url":"https://arxiv.org/abs/2506.04962","tags":["web"]},{"url":"https://arxiv.org/pdf/2506.04962","tags":["web"]},{"url":"https://github.com/advisories/GHSA-pq67-2wwv-3xjx"},{"url":"https://registry.npmjs.org","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/12xxx/CVE-2024-12905.json","tags":["advisory"]},{"url":"https://github.com/mafintosh/tar-fs","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-12905","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0194.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33674","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2UGLXZO6VIHGIITQTEUY5Q5YCAP2A4ZP/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VEDIJM7VQF4Q2L2KKQ6KJ2WZNR7AXYQD/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-12905","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-12905","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8367-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-48387","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-59343","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-12905","description":"An Improper Link Resolution Before File Access (\"Link Following\") and Improper Limitation of a Pathname to a Restricted Directory (\"Path Traversal\"). This vulnerability occurs when extracting a maliciously crafted tar file, which can result in unauthorized file writes or overwrites outside the intended extraction directory. The issue is associated with index.js in the tar-fs package.\n\nThis issue affects tar-fs: from 0.0.0 before 1.16.4, from 2.0.0 before 2.1.2, from 3.0.0 before 3.0.8.","status":"published","published":"2025-03-27T16:25:34.41Z","modified":"2025-11-03T19:29:11.81Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-59","CWE-22"],"updated_at":"2026-11-02T14:34:12.635756Z"}],"euvd":[{"id":"EUVD-2024-54315","description":"An Improper Link Resolution Before File Access (\"Link Following\") and Improper Limitation of a Pathname to a Restricted Directory (\"Path Traversal\"). This vulnerability occurs when extracting a maliciously crafted tar file, which can result in unauthorized file writes or overwrites outside the intended extraction directory. The issue is associated with index.js in the tar-fs package.\n\nThis issue affects tar-fs: from 0.0.0 before 1.16.4, from 2.0.0 before 2.1.2, from 3.0.0 before 3.0.8.","status":"published","published":"2025-03-27T16:25:34Z","modified":"2025-11-03T19:29:11Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T19:49:33.639996Z"}],"ghsa":[{"id":"GHSA-pq67-2wwv-3xjx","title":"tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File","description":"An Improper Link Resolution Before File Access (\"Link Following\") and Improper Limitation of a Pathname to a Restricted Directory (\"Path Traversal\"). This vulnerability occurs when extracting a maliciously crafted tar file, which can result in unauthorized file writes or overwrites outside the intended extraction directory. The issue is associated with index.js in the tar-fs package.\n\nThis issue affects tar-fs: from 0.0.0 before 1.16.4, from 2.0.0 before 2.1.2, from 3.0.0 before 3.0.7.\n\n### PoC\n```javascript\n// Create a writable stream to extract the tar content\nconst extractStream = tarfs.extract('/', {\n    // We can ignore the file type checks to allow the extraction of the malicious file\n    ignore: (name) =\u003e false,\n});\n\n// Create a tar stream\nconst tarStream = tarfs.pack().on('error', (err) =\u003e {\n    throw err;\n});\n\n// Append the malicious entry to the tar stream\ntarStream.entry({ name: '/flag.txt', mode: 0o644 }, Buffer.from('This is a flag!'));\n\n// Finalize the tar stream\ntarStream.finalize();\n\n// Pipe the tar stream into the extract stream\ntarStream.pipe(extractStream);\n```","status":"published","published":"2025-03-27T18:31:28Z","modified":"2025-11-03T22:55:00Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:39:05.278442Z"}],"nvd":[{"id":"CVE-2024-12905","description":"An Improper Link Resolution Before File Access (\"Link Following\") and Improper Limitation of a Pathname to a Restricted Directory (\"Path Traversal\"). This vulnerability occurs when extracting a maliciously crafted tar file, which can result in unauthorized file writes or overwrites outside the intended extraction directory. The issue is associated with index.js in the tar-fs package.\n\nThis issue affects tar-fs: from 0.0.0 before 1.16.4, from 2.0.0 before 2.1.2, from 3.0.0 before 3.0.8.","status":"published","published":"2025-03-27T17:15:53.25Z","modified":"2026-06-17T07:00:44.367Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-22","CWE-59"],"updated_at":"2026-11-02T14:10:45.815983Z"}],"osv":[{"id":"CVE-2024-12905","description":"An Improper Link Resolution Before File Access (\"Link Following\") and Improper Limitation of a Pathname to a Restricted Directory (\"Path Traversal\"). This vulnerability occurs when extracting a maliciously crafted tar file, which can result in unauthorized file writes or overwrites outside the intended extraction directory. The issue is associated with index.js in the tar-fs package.\n\nThis issue affects tar-fs: from 0.0.0 before 1.16.4, from 2.0.0 before 2.1.2, from 3.0.0 before 3.0.8.","status":"published","published":"2025-03-27T16:25:34.41Z","modified":"2026-10-28T02:30:31.497260108Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-22","CWE-59"],"updated_at":"2026-11-02T15:44:37.917085Z"},{"id":"DEBIAN-CVE-2024-12905","description":"An Improper Link Resolution Before File Access (\"Link Following\") and Improper Limitation of a Pathname to a Restricted Directory (\"Path Traversal\"). This vulnerability occurs when extracting a maliciously crafted tar file, which can result in unauthorized file writes or overwrites outside the intended extraction directory. The issue is associated with index.js in the tar-fs package.  This issue affects tar-fs: from 0.0.0 before 1.16.4, from 2.0.0 before 2.1.2, from 3.0.0 before 3.0.8.","status":"published","published":"2025-03-27T17:15:53.25Z","modified":"2026-11-02T12:00:27.65519871Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"GHSA-pq67-2wwv-3xjx","title":"tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File","description":"An Improper Link Resolution Before File Access (\"Link Following\") and Improper Limitation of a Pathname to a Restricted Directory (\"Path Traversal\"). This vulnerability occurs when extracting a maliciously crafted tar file, which can result in unauthorized file writes or overwrites outside the intended extraction directory. The issue is associated with index.js in the tar-fs package.\n\nThis issue affects tar-fs: from 0.0.0 before 1.16.4, from 2.0.0 before 2.1.2, from 3.0.0 before 3.0.7.\n\n### PoC\n```javascript\n// Create a writable stream to extract the tar content\nconst extractStream = tarfs.extract('/', {\n    // We can ignore the file type checks to allow the extraction of the malicious file\n    ignore: (name) =\u003e false,\n});\n\n// Create a tar stream\nconst tarStream = tarfs.pack().on('error', (err) =\u003e {\n    throw err;\n});\n\n// Append the malicious entry to the tar stream\ntarStream.entry({ name: '/flag.txt', mode: 0o644 }, Buffer.from('This is a flag!'));\n\n// Finalize the tar stream\ntarStream.finalize();\n\n// Pipe the tar stream into the extract stream\ntarStream.pipe(extractStream);\n```","status":"published","published":"2025-03-27T18:31:28Z","modified":"2026-09-10T03:50:23.170767408Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:53.700556Z"},{"id":"ROOT-APP-NPM-CVE-2024-12905","title":"CVE-2024-12905 in tar-fs - Patched by Root","description":"Root has patched CVE-2024-12905 in the tar-fs package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-11-06T12:16:13Z","modified":"2026-11-06T13:15:18.666285283Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"UBUNTU-CVE-2024-12905","description":"An Improper Link Resolution Before File Access (\"Link Following\") and Improper Limitation of a Pathname to a Restricted Directory (\"Path Traversal\"). This vulnerability occurs when extracting a maliciously crafted tar file, which can result in unauthorized file writes or overwrites outside the intended extraction directory. The issue is associated with index.js in the tar-fs package. This issue affects tar-fs: from 0.0.0 before 1.16.4, from 2.0.0 before 2.1.2, from 3.0.0 before 3.0.8.","status":"published","published":"2025-03-27T17:15:00Z","modified":"2026-06-02T18:16:00.948162726Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:54:41.555387Z"},{"id":"AZL-59367","title":"CVE-2024-12905 affecting package reaper for versions less than 3.1.1-18","description":"An Improper Link Resolution Before File Access (\"Link Following\") and Improper Limitation of a Pathname to a Restricted Directory (\"Path Traversal\"). This vulnerability occurs when extracting a maliciously crafted tar file, which can result in unauthorized file writes or overwrites outside the intended extraction directory. The issue is associated with index.js in the tar-fs package.\n\nThis issue affects tar-fs: from 0.0.0 before 1.16.4, from 2.0.0 before 2.1.2, from 3.0.0 before 3.0.8.","status":"published","published":"2025-03-27T17:15:53Z","modified":"2026-04-21T04:37:16.232621Z","updated_at":"2026-11-02T15:28:07.517393Z"},{"id":"CLSA-2026-1774484497","title":"TuxCare security update for tar-fs (5 CVEs)","description":"TuxCare rebuilt tar-fs to address 5 CVEs. Fixed in 1.5.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:15Z","modified":"2026-10-15T09:47:03.625091925Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1788560472","title":"TuxCare security update for tar-fs (3 CVEs)","description":"TuxCare rebuilt tar-fs to address 3 CVEs. Fixed in 3.0.4-tuxcare.1.","status":"published","published":"2026-09-04T22:21:12Z","modified":"2026-10-15T09:48:03.105068614Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1790963499","title":"TuxCare security update for tar-fs (3 CVEs)","description":"TuxCare rebuilt tar-fs to address 3 CVEs. Fixed in 2.1.1-tuxcare.1.","status":"published","published":"2026-10-02T17:51:39Z","modified":"2026-10-15T09:47:58.002826907Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"DLA-4214-1","title":"node-tar-fs - security update","status":"published","published":"2025-06-11T00:00:00Z","modified":"2026-03-09T02:11:20.667867Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2025-0194","title":"Updated yarnpkg packages fix security vulnerabilities","description":"CVE-2024-37890 yarnpkg: denial of service when handling a request with\nmany HTTP headers.\nCVE-2024-48949 yarnpkg: Missing Validation in Elliptic's EDDSA Signature\nVerification.\nCVE-2024-12905 yarnpkg: link following and path traversal via\nmaliciously crafted tar file\nAnd other vulnerabilities in the yarn's bundled nodejs components are\nfixed too, see the references.\n","status":"published","published":"2025-06-25T05:31:45Z","modified":"2026-04-16T04:42:54.764506997Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"USN-8367-1","title":"node-tar-fs vulnerabilities","description":"It was discovered that tar-fs did not properly limit paths when\nextracting crafted tar files. An attacker could possibly use this\nissue to write or overwrite files outside the intended extraction\ndirectory. This issue only affected Ubuntu 22.04 LTS and Ubuntu\n24.04 LTS. (CVE-2024-12905)\n\nIt was discovered that tar-fs did not properly validate extraction\npaths for certain crafted tar archives. An attacker could possibly\nuse this issue to write files outside the intended extraction\ndirectory. This issue only affected Ubuntu 22.04 LTS and Ubuntu\n24.04 LTS. (CVE-2025-48387)\n\nIt was discovered that tar-fs had a symlink validation bypass when\nextracting crafted tar files. An attacker could possibly use this\nissue to write files outside the intended extraction directory.\n(CVE-2025-59343)","status":"published","published":"2026-06-02T13:00:16Z","modified":"2026-06-02T18:33:02.168695126Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}