PT-2025-39311 · Fs/Tar+4 · Tar-Fs+4

Published 2025-01-01 · Updated 2026-06-04 · CVE-2025-59343

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions tar-fs versions prior to 3.1.1 tar-fs versions prior to 2.1.3 tar-fs version 1.16.5

Description tar-fs provides filesystem bindings for tar-stream. Affected versions are susceptible to a symlink validation bypass if the destination directory is predictable with a specific tarball. A workaround involves using the ignore option on non files/directories.

Recommendations Update tar-fs to version 3.1.1 or later. Update tar-fs to version 2.1.4 or later. Update tar-fs to version 1.16.6 or later. As a workaround, use the ignore option on non files/directories.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

CWE-61

Related Identifiers

BDU:2026-02201

CVE-2025-59343

DLA-4313-1

DSA-6013-1

GHSA-VJ76-C3G6-QR5V

OPENSUSE-SU-2025:15582-1

RHSA-2025:18979

RHSA-2025:19201

USN-8367-1

Affected Products

Confluence

Debian

Linuxmint

Ubuntu

Tar-Fs

References · 33

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59343.json · Exploit
• https://osv.dev/vulnerability/DSA-6013-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-59343 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-48387 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8367-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4313-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-59343 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59343 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59343 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2025-59343 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-59343 · Security Note
• https://osv.dev/vulnerability/GHSA-vj76-c3g6-qr5v · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02201 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-59343 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15582-1 · Vendor Advisory