PT-2025-13380 · Npm+4 · Tar-Fs+4
Bnbdr
·
Published
2025-03-27
·
Updated
2026-06-04
·
CVE-2024-12905
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
tar-fs versions 0.0.0 through 1.16.3
tar-fs versions 2.0.0 through 2.1.1
tar-fs versions 3.0.0 through 3.0.7
Description
This issue is related to an Improper Link Resolution Before File Access ("Link Following") and Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal"). The vulnerability occurs when extracting a maliciously crafted tar file, which can result in unauthorized file writes or overwrites outside the intended extraction directory. The issue is associated with index.js in the tar-fs package.
Recommendations
For tar-fs versions 0.0.0 through 1.16.3, update to version 1.16.4 or later.
For tar-fs versions 2.0.0 through 2.1.1, update to version 2.1.2 or later.
For tar-fs versions 3.0.0 through 3.0.7, update to version 3.0.8 or later.
As a temporary workaround, consider disabling the extraction of tar files until a patch is available.
Restrict access to the index.js file in the tar-fs package to minimize the risk of exploitation.
Exploit
Fix
RCE
Link Following
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Confluence
Debian
Linuxmint
Ubuntu
Tar-Fs