What is the CVSS score of CVE-2025-45582?

CVE-2025-45582 has a CVSS 3.1 base score of 4.1 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:L. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2025-45582?

Yes, a public proof-of-concept exploit is available for CVE-2025-45582. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-45582?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Tar CVE-2025-45582

EUVD-2025-21178 MEDIUM

Path Traversal: '../filedir' (CWE-24)

2025-07-11 cve@mitre.org

Path Traversal Ubuntu Red Hat Tar Suse Gnu

4.1

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-24 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V5 - File Handling Path traversal prevention
Impact	Sensitive files such as configuration files, credentials, or system files can be read, potentially leading to further compromise. With a CVSS score of 4.1 (MEDIUM), this represents a moderate risk.
Exploit ScenarioDerived	An attacker modifies a file parameter to include directory traversal sequences (../../etc/passwd) to read arbitrary files from the server filesystem.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 16, 2026

GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of "Member name contains '..'" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain "x -> ../../../../../home/victim/.ssh" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in which "tar xf" is run more than once (e.g., when installing a package can automatically install two dependencies that are set up as untrusted tarballs instead of official packages). NOTE: the official GNU Tar manual has an otherwise-empty directory for each "tar xf" in its Security Rules of Thumb; however, third-party advice leads users to run "tar xf" more than once into the same directory.

Earlier versions of this analysis (1)

v1 Mar 16, 2026 - 08:18 CVSS 4.1

RemediationAI

Validate and sanitize file path inputs. Use a whitelist of allowed files or directories. Implement chroot jails or containerization.

Affected VersionsENISA

Tar 0 ≤1.35

Affected Packages

euvd tar no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Path traversal allows an attacker to access files outside the intended directory by manipulating file paths with sequences like '../'.

Know when Tar gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 4.1 MEDIUM

AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:L

Ubuntu MEDIUM

SUSE MEDIUM

Red Hat 5.6 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch released

Apr 06, 2026 - 08:30 nvd

Patch available

PoC Detected

Nov 02, 2025 - 01:15 vuln.today

Public exploit code

CVE Published

Jul 11, 2025 - 17:15 nvd

MEDIUM 4.1

Executive ViewAI

Why It Matters

Organizations using GNU Tar through 1.35 should be aware of moderate risk from CVE-2025-45582 rated CVSS 4.1. Exploitation could compromise the security of affected deployments. Proof-of-concept code is publicly available. Organizations should apply vendor updates when available and monitor for exploitation.

Business Impact: Low

Compensating Controls

Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.

Threat Intelligence Overview

EPSS Score

0.1%

Top 83% exploitable

Exploit

POC

Public exploit code exists

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS MSRC Vendor

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC Yes

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

Poc

System Exposure· derived

Small

Automatable· derived

Human Impact

Low

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +20

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Path Traversal HIGH

Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.

More in Tar

View all

CVE-2016-6321 HIGH Act Now POC

7.5 Dec 09

Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote atta

CVE-2026-24842 HIGH This Week POC

8.2 Jan 28

node-tar before version 7.5.7 contains a path traversal vulnerability where inconsistent path resolution between validat

CVE-2026-29786 HIGH This Week POC

8.2 Mar 07

Arbitrary file overwrite in node-tar before 7.5.10 lets a malicious tar archive write files outside the intended extract

CVE-2026-23745 HIGH This Week POC

8.2 Jan 16

Arbitrary file overwrite and symlink poisoning in the node-tar library (versions <= 7.5.2) lets a malicious tar archive

CVE-2021-38511 HIGH This Week POC

7.5 Aug 10

An issue was discovered in the tar crate before 0.4.36 for Rust. Rated high severity (CVSS 7.5), this vulnerability is r

CVE-2021-32804 HIGH Act Now

8.1 Aug 03

The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overw

CVE-2026-26960 HIGH This Week POC

7.1 Feb 20

Path traversal in node-tar versions 7.5.7 and earlier allows local attackers to read and write arbitrary files outside t

CVE-2024-28863 MEDIUM This Month POC

6.5 Mar 21

node-tar is a Tar for Node.js. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authenti

CVE-2026-23950 MEDIUM This Month POC

5.9 Jan 20

Symlink poisoning via race condition in node-tar up to version 7.5.3 allows attackers to exploit Unicode normalization o

CVE-2021-32803 HIGH This Week

8.1 Aug 03

The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Over

CVE-2021-37701 HIGH This Week

8.6 Aug 31

The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite a

CVE-2018-20482 MEDIUM This Month POC

4.7 Dec 26

GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to c

Same weakness CWE-24 – Path Traversal: '../filedir'

View all

CVE-2026-39813 CRITICAL POC

9.8

CVE-2023-7134 CRITICAL POC

9.8

CVE-2023-3057 CRITICAL POC

9.8

CVE-2023-3056 CRITICAL POC

9.8

CVE-2023-1800 CRITICAL POC

9.8

CVE-2025-61318 CRITICAL POC

9.1

CVE-2023-6900 CRITICAL POC

9.1

CVE-2025-53513 HIGH POC

8.8

Same technique Path Traversal

View all

CVE-2019-19781 CRITICAL POC

9.8

CVE-2021-21972 CRITICAL POC

9.8

CVE-2021-40444 HIGH POC

8.8

CVE-2022-41352 CRITICAL POC

9.8

CVE-2021-27065 HIGH POC

7.8

CVE-2018-20250 HIGH POC

7.8

CVE-2022-37042 CRITICAL POC

9.8

CVE-2025-64446 CRITICAL POC

9.8

Vendor StatusVendor

Ubuntu

Priority: Medium

tar

Release	Status	Version
bionic	needed	-
upstream	needs-triage	-
focal	needed	-
jammy	needed	-
noble	needed	-
questing	needed	-
trusty	needed	-
xenial	needed	-
plucky	ignored	end of life, was needed

SUSE

Severity: Medium

Product	Status
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.152 Container suse/sl-micro/6.0/base-os-container:2.1.3-7.119 Container suse/sl-micro/6.0/toolbox:13.2-9.87 Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.82 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.105 Image SL-Micro Image SL-Micro-Base Image SL-Micro-Base-RT Image SL-Micro-Base-RT-SelfInstall Image SL-Micro-Base-RT-encrypted Image SL-Micro-Base-SelfInstall Image SL-Micro-Base-encrypted Image SL-Micro-Base-qcow Image SL-Micro-Default Image SL-Micro-Default-SelfInstall Image SL-Micro-Default-encrypted Image SL-Micro-Default-qcow Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2	Affected
Container suse/sle-micro-rancher/5.2:latest Container suse/sle-micro/5.2/toolbox:14.2-7.11.266 Container suse/sle-micro/base-5.5:latest	Affected
SUSE Liberty Linux 9	Fixed
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Fixed

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back