EUVD-2025-16687
GHSA-8cj5-5rvv-wf4v
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 8.7 score is driven by high integrity impact (VI:H), network accessibility (AV:N), and low attack complexity (AC:L), indicating straightforward exploitation. However, real-world risk depends on deployment context: (1) if tar-fs is used in server-side extract operations processing user-supplied or untrusted tarballs, risk is HIGH; (2) if used only for trusted archive processing, risk is LOWER. The CVSS vector indicates no authentication required (PR:N) and no user interaction (UI:N), maximizing attack surface. Absence of confirmed KEV status and public POC suggests this is not yet actively exploited in the wild, but the straightforward nature of path traversal attacks means weaponization is trivial. Organizations using tar-fs in web services, file upload processors, or CI/CD pipelines should prioritize immediate patching. The workaround (ignore option) is available but operationally limiting. |
| Exploit ScenarioDerived | An attacker uploads a maliciously crafted tar archive to a web application using tar-fs for file extraction. The tar archive contains an entry with a path like '../../../etc/config.json' or an absolute path '/etc/passwd'. When the server calls tar.extract(uploadDir, { ... }), the vulnerable tar-fs version fails to sanitize the path and writes the attacker's content outside uploadDir—potentially overwriting application configuration files, stealing sensitive data, or achieving code execution if the application later executes extracted files. The attack requires no authentication (PR:N) and no user interaction beyond upload (UI:N), making it easily automatable via script or crawler. Exploitation complexity is low (AC:L) as path traversal is a well-understood technique, though actual impact depends on filesystem permissions and application logic post-extraction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 14, 2026
tar-fs versions prior to 3.0.9, 2.1.3, and 1.16.5 contain a path traversal vulnerability (CWE-22) that allows attackers to extract tar archives outside the intended directory using specially crafted tarballs. This affects all users of vulnerable tar-fs versions with network-accessible extraction endpoints; the high CVSS 8.7 score reflects the integrity impact and network-accessible attack vector, though no KEV status or widespread public exploits have been confirmed at this time.
RemediationAI
Upgrade npm tar-fs package to patched versions; details: ['For 1.x users: upgrade to 1.16.5 or later', 'For 2.x users: upgrade to 2.1.3 or later', 'For 3.x users: upgrade to 3.0.9 or later']; command: npm update tar-fs@latest Workaround: Use the ignore option to filter non-file/directory entries; details: Configure the extract() function with an ignore predicate that rejects symbolic links, device files, and other special file types that could facilitate traversal attacks. This is a temporary mitigation and does not address all path traversal vectors.; code_example: tar.extract(dir, { ignore: (name, header) => header.type ! 'file' && header.type ! 'directory' }) Validation: Implement path validation before extraction; details: Independently validate all extracted file paths using path.resolve() and path.relative() to ensure paths remain within the target directory. Reject any paths that traverse outside the extraction root. Operational: Process untrusted tarballs in sandboxed environments; details: Extract user-supplied tarballs in isolated containers or chroot jails to limit damage from successful path traversal exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
tar-fs is a Node.js module that provides filesystem bindings for tar-stream, enabling extraction and creation of tar archives. The vulnerability is rooted in CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - 'Path Traversal'), where the extraction logic fails to properly validate and sanitize file paths extracted from tar headers before writing to the filesystem. Attackers can embed path traversal sequences (e.g., '../../../etc/passwd') or absolute paths in tar archive member headers, causing the extract() function to write files outside the intended extraction directory. Affected CPE identifiers include npm:tar-fs across all three major version branches (1.x, 2.x, 3.x) prior to their respective patch releases.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified dir with a specific tarball. This has been patched in versions 3.0.9, 2.1.3, and 1.16.5. As a workaround, use the ignore option to ignore non files/directories.
Executive ViewAI
A path traversal vulnerability in tar-fs library versions prior to 3.0.9, 2.1.3, and 1.16.5 allows malicious tar archives to write files outside their intended extraction directory, potentially compromising system integrity and data confidentiality. Any application using vulnerable versions of this library to extract untrusted tar archives faces immediate risk of unauthorized file writes and system compromise.
Until patching is complete: (1) Implement strict input validation to reject suspicious tar archives with path traversal patterns; (2) Run tar extraction processes in isolated containers or VMs with restricted filesystem permissions; (3) Use the 'ignore' option in tar-fs configuration to exclude non-file/directory entries; (4) Apply principle of least privilege—limit extraction operations to dedicated service accounts with minimal filesystem write permissions; (5) Monitor filesystem write operations during extraction for anomalous activity outside intended directories.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Same weakness CWE-22 – Path Traversal
View allSame technique Information Disclosure
View allVendor StatusVendor
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| focal | DNE | - |
| jammy | needs-triage | - |
| noble | needs-triage | - |
| upstream | needs-triage | - |
| oracular | ignored | end of life, was needs-triage |
| questing | needs-triage | - |
| plucky | ignored | end of life, was needs-triage |
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | fixed | 2.1.3-0+deb11u1 | - |
| bullseye (security) | fixed | 2.1.3-0+deb11u2 | - |
| bookworm, bookworm (security) | fixed | 2.1.3-0+deb12u2 | - |
| trixie (security), trixie | fixed | 3.0.9+~cs2.0.4-1+deb13u1 | - |
| forky, sid | fixed | 3.0.9+~cs2.0.4-2 | - |
| bookworm | fixed | 2.1.3-0+deb12u1 | - |
| (unstable) | fixed | 3.0.9+~cs2.0.4-1 | - |
Exploit-DB