GitStock

mafintosh/tar-fs · Security

tar-fs can extract outside the specified dir with a specific tarball

GHSA ID
GHSA-8cj5-5rvv-wf4v
CVE ID
CVE-2025-48387
Severity
high
Published
Updated
CVSS v4
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Description

Impact

v3.0.8, v2.1.2, v1.16.4 and below

Patches

Has been patched in 3.0.9, 2.1.3, and 1.16.5

Workarounds

You can use the ignore option to ignore non files/directories.

  ignore (_, header) {
    // pass files & directories, ignore e.g. symlinks
    return header.type !== 'file' && header.type !== 'directory'
  }

Credit

Thank you Caleb Brown from Google Open Source Security Team for reporting this in detail.

CWEs

  • CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

References

Open GitHub