CVE-2026-23745
MEDIUM
GHSA-8qq5-rm4j-mr97
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Lifecycle Timeline
4Description
node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.
Analysis
node-tar versions 7.5.2 and earlier fail to properly sanitize link paths in tar archives when the default secure mode is enabled, allowing attackers to extract files outside the intended directory through malicious hardlinks and symlinks. Public exploit code exists for this vulnerability, which affects Node.js applications and related products including D-Link and Tar utilities. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Review file handling controls.
Sign in for detailed remediation steps.
Priority Score
Vendor Status
Share
External POC / Exploit Code
Leaving vuln.today