Skip to content
OpenAdvisories
High USN-8367-1 3 CVEs

node-tar-fs vulnerabilities

Published Jun 2, 2026 · Updated Jun 2, 2026

Ecosystem: Ubuntu

Summary

It was discovered that tar-fs did not properly limit paths when
extracting crafted tar files. An attacker could possibly use this
issue to write or overwrite files outside the intended extraction
directory. This issue only affected Ubuntu 22.04 LTS and Ubuntu
24.04 LTS. (CVE-2024-12905)

It was discovered that tar-fs did not properly validate extraction
paths for certain crafted tar archives. An attacker could possibly
use this issue to write files outside the intended extraction
directory. This issue only affected Ubuntu 22.04 LTS and Ubuntu
24.04 LTS. (CVE-2025-48387)

It was discovered that tar-fs had a symlink validation bypass when
extracting crafted tar files. An attacker could possibly use this
issue to write files outside the intended extraction directory.
(CVE-2025-59343)

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 25.10 node-tar-fs 3.0.9+~cs2.0.4-1+deb13u1build0.25.10.1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS node-tar-fs 2.1.1-6ubuntu0.22.04.1~esm1
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS node-tar-fs 2.1.1-6ubuntu0.24.04.1~esm1

Vulnerabilities 3

  • High 8.7
    CVE-2025-48387

    tar-fs has issue where extract can write outside the specified dir with a specific tarball

    tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified dir with a specific tarball. This has been patched in versions 3.0.9, 2.1.3, and 1.16.5. As a workaro…

    Mafintosh tar-fs jitsucom-jitsu-console sqlpad Debian Ubuntu Azure Linux Wolfi npm
  • High 8.7
    CVE-2025-59343

    tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball

    tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.1.1, 2.1.3, and 1.16.5 are vulnerable to symlink validation bypass if the destination directory is predictable with a specific tarball. This issue has been patched in version 3.1.1, 2.1.4…

    Mafintosh tar-fs sqlpad code-server Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2024-12905 Public exploit

    tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File

    An Improper Link Resolution Before File Access ("Link Following") and Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal"). This vulnerability occurs when extracting a maliciously crafted tar file, which can result in unauthorized fi…

    sqlpad code-server tileserver-gl reaper Debian Ubuntu Azure Linux Wolfi npm

References

  • report
    https://ubuntu.com/security/CVE-2024-12905
  • report
    https://ubuntu.com/security/CVE-2025-48387
  • report
    https://ubuntu.com/security/CVE-2025-59343