PT-2025-23554 · Fs/Tar+4 · Tar-Fs+4

Mafintosh · Publicado 2025-05-22 · Atualizado 2026-06-04 · CVE-2025-48387

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions tar-fs versions prior to 3.0.9 tar-fs versions prior to 2.1.3 tar-fs versions prior to 1.16.5

Description The issue in tar-fs allows an extract to write outside the specified directory with a specific tarball. This is due to improper limitation of a pathname to a restricted directory, also known as path traversal.

Recommendations For versions prior to 3.0.9, update to version 3.0.9 or later. For versions prior to 2.1.3, update to version 2.1.3 or later. For versions prior to 1.16.5, update to version 1.16.5 or later. As a temporary workaround, consider using the ignore option to ignore non-files/directories.

Exploit

Correção

RCE

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

AZL-62236

BDU:2025-10095

CVE-2025-48387

DLA-4214-1

GHSA-8CJ5-5RVV-WF4V

GHSA-XRG4-QP5W-2C3W

MGASA-2025-0194

USN-8367-1

Produtos afetados

Confluence

Debian

Linuxmint

Ubuntu

Tar-Fs

Referências · 41

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48387.json · Exploit
• https://github.com/google/security-research/security/advisories/GHSA-xrg4-qp5w-2c3w · Nota
• https://github.com/mafintosh/tar-fs/commit/647447b572bc135c41035e82ca7b894f02b17f0f · Nota
• https://github.com/mafintosh/tar-fs/security/advisories/GHSA-8cj5-5rvv-wf4v · Nota
• https://github.com/mafintosh/tar-fs · Nota
• https://security-tracker.debian.org/tracker/CVE-2025-48387 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/VEDIJM7VQF4Q2L2KKQ6KJ2WZNR7AXYQD · Aviso do Fabricante
• https://lists.debian.org/debian-lts-announce/2025/06/msg00012.html · Nota
• https://twitter.com/CVEnew/status/1929624878514426081 · Publicação no Twitter
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2025-48387 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-48387 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2025-10095 · Nota de Segurança
• https://twitter.com/the_yellow_fall/status/1957259405021581485 · Publicação no Twitter
• https://jira.atlassian.com/browse/CONFSERVER-101479 · Nota
• https://osv.dev/vulnerability/GHSA-8cj5-5rvv-wf4v · Aviso do Fabricante