An Improper Link Resolution Before File Access ("Link Following") and Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal"). This vulnerability occurs when extracting a maliciously crafted tar file, which can result in unauthorized file writes or overwrites outside the intended extraction directory. The issue is associated with index.js in the tar-fs package.
This issue affects tar-fs: from 0.0.0 before 1.16.4, from 2.0.0 before 2.1.2, from 3.0.0 before 3.0.8.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade node-tar-fs | May 15, 2025 | Mar 27, 2025 |
| Red Hat Jboss Eap | — | — | Apr 1, 2025 | Mar 27, 2025 |
| Ubuntu | — | Upgrade node-tar-fsUpgrade node-tar-fs (Ubuntu Pro) | Jun 3, 2026 | Jun 2, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub