CVE-2025-48387
tar-fs has issue where extract can write outside the specified dir with a specific tarball
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
tar-fs has issue where extract can write outside the specified dir with a specific tarball
tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified dir with a specific tarball. This has been patched in versions 3.0.9, 2.1.3, and 1.16.5. As a workaround, use the ignore option to ignore non files/directories.
Reserved 2025-05-19 | Published 2025-06-02 | Updated 2025-06-03 | Assigner GitHub_MCWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
github.com/...tar-fs/security/advisories/GHSA-8cj5-5rvv-wf4v
github.com/...ommit/647447b572bc135c41035e82ca7b894f02b17f0f
Support options
