How to fix CVE-2025-48387?

Within 24 hours: Identify all applications and services using tar-fs library and document current versions in use; assess whether your organization processes untrusted tar files. Within 7 days: Prioritize upgrading to patched versions (3.0.9, 2.1.3, or 1.16.5) for all affected dependencies; test thoroughly in staging environments. Within 30 days: Complete rollout of patched versions to all production systems; implement input validation and restrict tar extraction to isolated sandboxed environments.

Is Redhat affected by CVE-2025-48387?

A path traversal vulnerability in tar-fs library versions prior to 3.0.9, 2.1.3, and 1.16.5 allows malicious tar archives to write files outside their intended extraction directory, potentially compromising system integrity and data confidentiality.

CVE-2025-48387

EUVD-2025-16687 HIGH

2025-06-02 [email protected]

GHSA-8cj5-5rvv-wf4v

Information Disclosure Redhat

8.7

CVSS 4.0

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Lifecycle Timeline

Patch Released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 14, 2026 - 16:47 vuln.today

EUVD ID Assigned

Mar 14, 2026 - 16:47 euvd

EUVD-2025-16687

CVE Published

Jun 02, 2025 - 20:15 nvd

HIGH 8.7

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

872 npm packages depend on tar-fs (27 direct, 845 indirect)

Ecosystem-wide dependent count for version 2.0.0.

DescriptionNVD

tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified dir with a specific tarball. This has been patched in versions 3.0.9, 2.1.3, and 1.16.5. As a workaround, use the ignore option to ignore non files/directories.

AnalysisAI

tar-fs versions prior to 3.0.9, 2.1.3, and 1.16.5 contain a path traversal vulnerability (CWE-22) that allows attackers to extract tar archives outside the intended directory using specially crafted tarballs. This affects all users of vulnerable tar-fs versions with network-accessible extraction endpoints; the high CVSS 8.7 score reflects the integrity impact and network-accessible attack vector, though no KEV status or widespread public exploits have been confirmed at this time.

Technical ContextAI

tar-fs is a Node.js module that provides filesystem bindings for tar-stream, enabling extraction and creation of tar archives. The vulnerability is rooted in CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - 'Path Traversal'), where the extraction logic fails to properly validate and sanitize file paths extracted from tar headers before writing to the filesystem. Attackers can embed path traversal sequences (e.g., '../../../etc/passwd') or absolute paths in tar archive member headers, causing the extract() function to write files outside the intended extraction directory. Affected CPE identifiers include npm:tar-fs across all three major version branches (1.x, 2.x, 3.x) prior to their respective patch releases.

RemediationAI

Upgrade npm tar-fs package to patched versions; details: ['For 1.x users: upgrade to 1.16.5 or later', 'For 2.x users: upgrade to 2.1.3 or later', 'For 3.x users: upgrade to 3.0.9 or later']; command: npm update tar-fs@latest Workaround: Use the ignore option to filter non-file/directory entries; details: Configure the extract() function with an ignore predicate that rejects symbolic links, device files, and other special file types that could facilitate traversal attacks. This is a temporary mitigation and does not address all path traversal vectors.; code_example: tar.extract(dir, { ignore: (name, header) => header.type ! 'file' && header.type ! 'directory' }) Validation: Implement path validation before extraction; details: Independently validate all extracted file paths using path.resolve() and path.relative() to ensure paths remain within the target directory. Reject any paths that traverse outside the extraction root. Operational: Process untrusted tarballs in sandboxed environments; details: Extract user-supplied tarballs in isolated containers or chroot jails to limit damage from successful path traversal exploitation.

Vendor StatusVendor

Ubuntu

Priority: Medium

node-tar-fs

Release	Status	Version
focal	DNE	-
jammy	needs-triage	-
noble	needs-triage	-
upstream	needs-triage	-
oracular	ignored	end of life, was needs-triage
questing	needs-triage	-
plucky	ignored	end of life, was needs-triage

Debian