PT-2025-23554 · Fs/Tar+4 · Tar-Fs+4

Mafintosh · Published 2025-05-22 · Updated 2026-06-04 · CVE-2025-48387

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions tar-fs versions prior to 3.0.9 tar-fs versions prior to 2.1.3 tar-fs versions prior to 1.16.5

Description The issue in tar-fs allows an extract to write outside the specified directory with a specific tarball. This is due to improper limitation of a pathname to a restricted directory, also known as path traversal.

Recommendations For versions prior to 3.0.9, update to version 3.0.9 or later. For versions prior to 2.1.3, update to version 2.1.3 or later. For versions prior to 1.16.5, update to version 1.16.5 or later. As a temporary workaround, consider using the ignore option to ignore non-files/directories.

Exploit

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

AZL-62236

BDU:2025-10095

CVE-2025-48387

DLA-4214-1

GHSA-8CJ5-5RVV-WF4V

GHSA-XRG4-QP5W-2C3W

MGASA-2025-0194

USN-8367-1

Affected Products

Confluence

Debian

Linuxmint

Ubuntu

Tar-Fs

References · 41

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48387.json · Exploit
• https://security-tracker.debian.org/tracker/CVE-2025-48387 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/VEDIJM7VQF4Q2L2KKQ6KJ2WZNR7AXYQD · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2025-48387 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-48387 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-10095 · Security Note
• https://osv.dev/vulnerability/GHSA-8cj5-5rvv-wf4v · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-12905 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/2UGLXZO6VIHGIITQTEUY5Q5YCAP2A4ZP · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-59343 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-48387 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2025-0194 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48387 · Security Note
• https://ubuntu.com/security/notices/USN-8367-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4214-1 · Vendor Advisory