{"id":"CVE-2025-48387","aliases":["AZL-62236","CLSA-2026-1774484497","CLSA-2026-1788560472","CLSA-2026-1790963499","DEBIAN-CVE-2025-48387","DLA-4214-1","EUVD-2025-16687","GHSA-8cj5-5rvv-wf4v","MGASA-2025-0194","ROOT-APP-NPM-CVE-2025-48387","UBUNTU-CVE-2025-48387","USN-8367-1","fix-test-env-compat"],"status":"published","title":"tar-fs has issue where extract can write outside the specified dir with a specific tarball","description":"tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified dir with a specific tarball. This has been patched in versions 3.0.9, 2.1.3, and 1.16.5. As a workaround, use the ignore option to ignore non files/directories.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00579,"percentile":0.47983,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2025-06-02T19:20:18Z","modified":"2026-11-06T13:15:19Z","fixes":[{"ecosystem":"npm","package":"tar-fs","fixed_in":["1.16.5","2.1.3","3.0.9"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:2","package":"reaper","fixed_in":["3.1.1-19"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-tar-fs","fixed_in":["2.1.3-0+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-tar-fs","fixed_in":["3.0.9+~cs2.0.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-tar-fs","fixed_in":["3.0.9+~cs2.0.4-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"tar-fs","fixed_in":["3.0.8-aikido.2","3.0.6-aikido.2","2.0.0-aikido.4","2.1.2-aikido.2","1.16.3-aikido.1","3.0.9-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/tar-fs","fixed_in":["3.0.8-root.io.1","3.0.6-root.io.1","2.0.0-root.io.2","2.0.0-root.io.3","3.0.8-root.io.2","2.0.0-root.io.4","2.1.2-root.io.2","3.0.6-root.io.2","1.16.3-root.io.1","3.0.9-root.io.1","3.0.9-root.io.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-tar-fs","fixed_in":["2.1.1-6ubuntu0.22.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"node-tar-fs","fixed_in":["2.1.1-6ubuntu0.24.04.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.5"}]}]},{"source":"ghsa","ecosystem":"npm","package":"tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.1.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.9"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"reaper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-19"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.1-tuxcare.0"},{"fixed":"1.5.1-tuxcare.1"}]}],"versions":["1.5.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.4-tuxcare.0"},{"fixed":"3.0.4-tuxcare.1"}]}],"versions":["3.0.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.1-tuxcare.0"},{"fixed":"2.1.1-tuxcare.1"}]}],"versions":["2.1.1"],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"node-tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-0+deb12u1"}]}],"versions":["2.1.1-6"]},{"source":"osv","ecosystem":"Debian:13","package":"node-tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9+~cs2.0.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9+~cs2.0.4-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"node-tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-0+deb11u1"}]}],"versions":["2.1.1-2","2.1.1-3","2.1.1-4","2.1.1-6"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"tar-fs","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.16.5"}]}]},{"source":"osv","ecosystem":"npm","package":"tar-fs","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.1.3"}]}]},{"source":"osv","ecosystem":"npm","package":"tar-fs","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.0.9"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"yarnpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.22-0.10.9.2.1.mga9"}]}],"bundled":11},{"source":"osv","ecosystem":"Root:npm","package":"tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-aikido.2"},{"fixed":"3.0.6-aikido.2"},{"fixed":"2.0.0-aikido.4"},{"fixed":"2.1.2-aikido.2"},{"fixed":"1.16.3-aikido.1"},{"fixed":"3.0.9-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-root.io.1"},{"fixed":"3.0.6-root.io.1"},{"fixed":"2.0.0-root.io.2"},{"fixed":"2.0.0-root.io.3"},{"fixed":"3.0.8-root.io.2"},{"fixed":"2.0.0-root.io.4"},{"fixed":"2.1.2-root.io.2"},{"fixed":"3.0.6-root.io.2"},{"fixed":"1.16.3-root.io.1"},{"fixed":"3.0.9-root.io.1"},{"fixed":"3.0.9-root.io.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-6ubuntu0.22.04.1~esm1"}]}],"versions":["2.1.1-2","2.1.1-4","2.1.1-6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"node-tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-6ubuntu0.24.04.1~esm1"}]}],"versions":["2.1.1-6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-6ubuntu0.22.04.1~esm1"}]}],"versions":["2.1.1-2","2.1.1-4","2.1.1-6"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"node-tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-6ubuntu0.24.04.1~esm1"}]}],"versions":["2.1.1-6"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-tar-fs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9+~cs2.0.4-1+deb13u1build0.25.10.1"}]}],"versions":["2.1.1-6","3.0.8+~cs2.0.4-1","3.0.9+~cs2.0.4-1"],"bundled":3}],"products":[{"vendor":"mafintosh","product":"tar-fs"}],"references":[{"url":"https://github.com/mafintosh/tar-fs/security/advisories/GHSA-8cj5-5rvv-wf4v","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/google/security-research/security/advisories/GHSA-xrg4-qp5w-2c3w","tags":["x_refsource_MISC","advisory","web"]},{"url":"https://github.com/mafintosh/tar-fs/commit/647447b572bc135c41035e82ca7b894f02b17f0f","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/06/msg00012.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48387","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-8cj5-5rvv-wf4v"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48387.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-48387","tags":["advisory"]},{"url":"https://github.com/mafintosh/tar-fs","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2025-0194.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33674","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2UGLXZO6VIHGIITQTEUY5Q5YCAP2A4ZP/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VEDIJM7VQF4Q2L2KKQ6KJ2WZNR7AXYQD/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-48387","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-48387","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8367-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-12905","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-59343","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-48387","title":"tar-fs has issue where extract can write outside the specified dir with a specific tarball","description":"tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified dir with a specific tarball. This has been patched in versions 3.0.9, 2.1.3, and 1.16.5. As a workaround, use the ignore option to ignore non files/directories.","status":"published","published":"2025-06-02T19:20:18.22Z","modified":"2025-11-03T20:04:45.253Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:32:41.089134Z"}],"euvd":[{"id":"EUVD-2025-16687","description":"tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified dir with a specific tarball. This has been patched in versions 3.0.9, 2.1.3, and 1.16.5. As a workaround, use the ignore option to ignore non files/directories.","status":"published","published":"2025-06-02T19:20:18Z","modified":"2025-11-03T20:04:45Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T19:49:32.896597Z"}],"ghsa":[{"id":"GHSA-8cj5-5rvv-wf4v","title":"tar-fs can extract outside the specified dir with a specific tarball","description":"### Impact\n v3.0.8, v2.1.2, v1.16.4 and below\n\n### Patches\nHas been patched in 3.0.9, 2.1.3, and 1.16.5\n\n### Workarounds\nYou can use the ignore option to ignore non files/directories.\n\n```js\n  ignore (_, header) {\n    // pass files \u0026 directories, ignore e.g. symlinks\n    return header.type !== 'file' \u0026\u0026 header.type !== 'directory'\n  }\n```\n\n### Credit\nThank you Caleb Brown from Google Open Source Security Team for reporting this in detail.","status":"published","published":"2025-06-03T06:14:25Z","modified":"2025-11-03T21:34:00Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:39:04.350802Z"}],"nvd":[{"id":"CVE-2025-48387","description":"tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified dir with a specific tarball. This has been patched in versions 3.0.9, 2.1.3, and 1.16.5. As a workaround, use the ignore option to ignore non files/directories.","status":"published","published":"2025-06-02T20:15:22.93Z","modified":"2026-06-17T09:29:35.47Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:11:10.143444Z"}],"osv":[{"id":"CVE-2025-48387","title":"tar-fs has issue where extract can write outside the specified dir with a specific tarball","description":"tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified dir with a specific tarball. This has been patched in versions 3.0.9, 2.1.3, and 1.16.5. As a workaround, use the ignore option to ignore non files/directories.","status":"published","published":"2025-06-02T19:20:18.22Z","modified":"2026-10-28T02:30:37.012117024Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:44:50.037003Z"},{"id":"DEBIAN-CVE-2025-48387","description":"tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified dir with a specific tarball. This has been patched in versions 3.0.9, 2.1.3, and 1.16.5. As a workaround, use the ignore option to ignore non files/directories.","status":"published","published":"2025-06-02T20:15:22.93Z","modified":"2026-09-01T20:03:35.778122634Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"GHSA-8cj5-5rvv-wf4v","title":"tar-fs can extract outside the specified dir with a specific tarball","description":"### Impact\n v3.0.8, v2.1.2, v1.16.4 and below\n\n### Patches\nHas been patched in 3.0.9, 2.1.3, and 1.16.5\n\n### Workarounds\nYou can use the ignore option to ignore non files/directories.\n\n```js\n  ignore (_, header) {\n    // pass files \u0026 directories, ignore e.g. symlinks\n    return header.type !== 'file' \u0026\u0026 header.type !== 'directory'\n  }\n```\n\n### Credit\nThank you Caleb Brown from Google Open Source Security Team for reporting this in detail.","status":"published","published":"2025-06-03T06:14:25Z","modified":"2026-09-10T03:50:24.933003874Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:42.077781Z"},{"id":"UBUNTU-CVE-2025-48387","description":"tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified dir with a specific tarball. This has been patched in versions 3.0.9, 2.1.3, and 1.16.5. As a workaround, use the ignore option to ignore non files/directories.","status":"published","published":"2025-06-02T20:15:00Z","modified":"2026-06-02T18:15:28.966364094Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:55:50.31802Z"},{"id":"AZL-62236","title":"CVE-2025-48387 affecting package reaper for versions less than 3.1.1-19","description":"tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified dir with a specific tarball. This has been patched in versions 3.0.9, 2.1.3, and 1.16.5. As a workaround, use the ignore option to ignore non files/directories.","status":"published","published":"2025-06-02T20:15:22Z","modified":"2026-04-21T04:31:58.423333Z","updated_at":"2026-11-02T15:28:07.805289Z"},{"id":"CLSA-2026-1774484497","title":"TuxCare security update for tar-fs (5 CVEs)","description":"TuxCare rebuilt tar-fs to address 5 CVEs. Fixed in 1.5.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:15Z","modified":"2026-10-15T09:47:03.625091925Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1788560472","title":"TuxCare security update for tar-fs (3 CVEs)","description":"TuxCare rebuilt tar-fs to address 3 CVEs. Fixed in 3.0.4-tuxcare.1.","status":"published","published":"2026-09-04T22:21:12Z","modified":"2026-10-15T09:48:03.105068614Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1790963499","title":"TuxCare security update for tar-fs (3 CVEs)","description":"TuxCare rebuilt tar-fs to address 3 CVEs. Fixed in 2.1.1-tuxcare.1.","status":"published","published":"2026-10-02T17:51:39Z","modified":"2026-10-15T09:47:58.002826907Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"DLA-4214-1","title":"node-tar-fs - security update","status":"published","published":"2025-06-11T00:00:00Z","modified":"2026-03-09T02:11:20.667867Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2025-0194","title":"Updated yarnpkg packages fix security vulnerabilities","description":"CVE-2024-37890 yarnpkg: denial of service when handling a request with\nmany HTTP headers.\nCVE-2024-48949 yarnpkg: Missing Validation in Elliptic's EDDSA Signature\nVerification.\nCVE-2024-12905 yarnpkg: link following and path traversal via\nmaliciously crafted tar file\nAnd other vulnerabilities in the yarn's bundled nodejs components are\nfixed too, see the references.\n","status":"published","published":"2025-06-25T05:31:45Z","modified":"2026-04-16T04:42:54.764506997Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"ROOT-APP-NPM-CVE-2025-48387","title":"CVE-2025-48387 in tar-fs - Patched by Root","description":"Root has patched CVE-2025-48387 in the tar-fs package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-11-06T12:16:13Z","modified":"2026-11-06T13:15:19.328482134Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"USN-8367-1","title":"node-tar-fs vulnerabilities","description":"It was discovered that tar-fs did not properly limit paths when\nextracting crafted tar files. An attacker could possibly use this\nissue to write or overwrite files outside the intended extraction\ndirectory. This issue only affected Ubuntu 22.04 LTS and Ubuntu\n24.04 LTS. (CVE-2024-12905)\n\nIt was discovered that tar-fs did not properly validate extraction\npaths for certain crafted tar archives. An attacker could possibly\nuse this issue to write files outside the intended extraction\ndirectory. This issue only affected Ubuntu 22.04 LTS and Ubuntu\n24.04 LTS. (CVE-2025-48387)\n\nIt was discovered that tar-fs had a symlink validation bypass when\nextracting crafted tar files. An attacker could possibly use this\nissue to write files outside the intended extraction directory.\n(CVE-2025-59343)","status":"published","published":"2026-06-02T13:00:16Z","modified":"2026-06-02T18:33:02.168695126Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}