Skip to content
OpenAdvisories

Vendor

Mafintosh

3 known vulnerabilities.

Products

tar-fs 2 Protocol-buffers-schema parser 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.7
    CVE-2025-59343

    tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball

    tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.1.1, 2.1.3, and 1.16.5 are vulnerable to symlink validation bypass if the destination directory is predictable with a specific tarball. This issue has been patched in version 3.1.1, 2.1.4…

    Mafintosh tar-fs sqlpad code-server Debian Ubuntu Wolfi npm
  • High 8.7
    CVE-2025-48387

    tar-fs has issue where extract can write outside the specified dir with a specific tarball

    tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified dir with a specific tarball. This has been patched in versions 3.0.9, 2.1.3, and 1.16.5. As a workaro…

    Mafintosh tar-fs jitsucom-jitsu-console sqlpad Debian Ubuntu Azure Linux Wolfi npm