Exploit for Path Traversal in Isaacs Tar

🗓️ 28 Mar 2026 20:49:46Reported by Recorded-texteditor120Type

Proof of concept for CVE-2026-31802 path traversal in npm tar that can overwrite files via symbolic links.

Reporter	Title	Published	Views	Family All 334
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple node modules.	21 Apr 202618:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses tar-7.5.9.tgz which is vulnerable to CVE-2026-31802	5 May 202611:29	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Voice Gateway	31 Mar 202615:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands are vulnerable to arbitrary code execution, loss of confidentiality and denial of service	6 May 202613:05	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Watsonx BI Assistant for CP4D	27 Apr 202616:13	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in node-tar affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	25 Aug 202618:24	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which is vulnerable to multiple CVEs.	27 Apr 202607:43	–	ibm
IBM Security Bulletins	Security Bulletin: The Pulse App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	30 Jul 202614:05	–	ibm
GithubExploit	Exploit for CVE-2026-31802	14 Mar 202622:04	–	githubexploit
GithubExploit	cve-2026-poc-collection	6 Aug 202601:26	–	githubexploit

28 Mar 2026 20:51Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.15.5

CVSS 48.2

EPSS0.00253

SSVC