PT-2026-20374 · Node-Tar+2 · Node-Tar+2
Scumfrog
·
Published
2026-02-18
·
Updated
2026-05-18
·
CVE-2026-26960
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
node-tar versions 7.5.7 and below
node-tar version 7.5.8
Description
The node-tar package contains a flaw where an attacker-controlled archive, when extracted using default options, can create a hardlink inside the extraction directory that points to a file outside the extraction root. This allows for arbitrary file read and write access as the user performing the extraction. The issue arises because path protections are bypassed, effectively turning archive extraction into a direct filesystem access operation. The bypass chain involves the use of symlinks and a hardlink to achieve this. Specifically, the vulnerability stems from string-based linkpath checks that do not resolve symlinks on disk, combined with how hardlink targets are resolved and the placement of parent directory safety checks. A proof-of-concept demonstrates the ability to read and write to files outside the intended extraction directory.
Recommendations
Versions prior to 7.5.8 should be updated to version 7.5.8 or later.
Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Confluence
Red Os
Node-Tar