We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
An Improper Link Resolution Before File Access ("Link Following") and Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal"). This vulnerability occurs when extracting a maliciously crafted tar file, which can result in unauthorized file writes or overwrites outside the intended extraction directory. The issue is associated with index.js in the tar-fs package. This issue affects tar-fs: from 0.0.0 before 1.16.4, from 2.0.0 before 2.1.2, from 3.0.0 before 3.0.8.
Reserved 2024-12-23 | Published 2025-03-27 | Updated 2025-04-20 | Assigner sealCWE-59 Improper Link Resolution Before File Access ('Link Following')
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
@bnbdr
github.com/...ommit/a1dd7e7c7f4b4a8bd2ab60f513baca573b44e2ed
www.seal.security/...ncovering-a-new-vulnerability-in-tar-fs
Support options
