tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball

🗓️ 24 Sep 2025 18:57:04Reported by GitHub Advisory DatabaseType

Tar-fs had a symlink validation bypass for predictable destinations; patched in later releases.

Reporter	Title	Published	Views	Family All 92
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to loss of confidentiality [CVE-2025-59343]	31 Oct 202511:17	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Langflow Desktop Symlink Validation Bypass	2 Apr 202615:42	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses tar-fs-2.1.3.tgz which is vulnerable to CVE-2025-59343.	1 Dec 202517:41	–	ibm
IBM Security Bulletins	Security Bulletin: Astronomer with IBM is vulnerable to symlink validation bypass due to the tar-fs package (CVE-2025-59343)	28 Nov 202519:10	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been found in IBM Verify Identity Access Digital Credentials (CVE-2025-56200, CVE-2025-64118, CVE-2025-59343)	9 Jan 202600:45	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Concert Software.	10 Feb 202604:45	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in tar-fs-2.1.1.tgz affecting MongoDB Enterprised Advanced (CVE-2025-59343)	24 Feb 202618:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Investigation Assistant app for IBM QRadar SIEM includes components with known vulnerabilities	16 Oct 202512:14	–	ibm
IBM Security Bulletins	Security Bulletin: Data Synchronization App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	2 Mar 202618:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to symlink validation bypass due to tar-fs ( CVE-2025-59343 )	15 Oct 202516:00	–	ibm

Vulners

Node

tar-fs_project tar-fsRange<1.16.6npm

tar-fs_project tar-fsRange2.0.0–2.1.4npm

tar-fs_project tar-fsRange3.0.0–3.1.1npm

Source	Link
github	www.github.com/mafintosh/tar-fs/security/advisories/GHSA-vj76-c3g6-qr5v
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-59343
github	www.github.com/mafintosh/tar-fs/commit/0bd54cdf06da2b7b5b95cd4b062c9f4e0a8c4e09
lists	www.lists.debian.org/debian-lts-announce/2025/09/msg00028.html
github	www.github.com/advisories/GHSA-vj76-c3g6-qr5v

03 Nov 2025 21:34Current

7High risk

Vulners AI Score7

CVSS 48.7

EPSS0.00033

SSVC