GitStock

mafintosh/tar-fs · Security

tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball

GHSA ID
GHSA-vj76-c3g6-qr5v
CVE ID
CVE-2025-59343
Severity
high
Published
Updated
CVSS v4
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Description

Impact

v3.1.0, v2.1.3, v1.16.5 and below

Patches

Has been patched in 3.1.1, 2.1.4, and 1.16.6

Workarounds

You can use the ignore option to ignore non files/directories.

  ignore (_, header) {
    // pass files & directories, ignore e.g. symlinks
    return header.type !== 'file' && header.type !== 'directory'
  }

Credit

Reported by: Mapta / BugBunny_ai

CWEs

  • CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
  • CWE-61 · UNIX Symbolic Link (Symlink) Following

References

Open GitHub