CVE-2025-48387

🗓️ 02 Jun 2025 19:20:18Reported by MendType

mend🔗 www.mend.io👁 2 Views

tar-fs allows an extract to write outside the specified dir with a specific tarball.

Reporter	Title	Published	Views	Family All 145
IBM Security Bulletins	Security Bulletin: Carbon design system packages	18 Aug 202519:26	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component is vulnerable to tar-fs-1.16.4.tgz CVE-2025-48387	8 Sep 202513:25	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Planning Analytics	27 Jun 202520:52	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in tar-fs affects IBM watsonx Orchestrate with watsonx Assistant Cartridge	10 Sep 202520:14	–	ibm
IBM Security Bulletins	Security Bulletin: Astronomer with IBM is vulnerable to unrestricted filesystem writes due to the tar-fs package (CVE-2025-48387)	20 Nov 202514:24	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities were found in IBM Verify Identity Access Digital Credentials (CVE-2025-48387, CVE-2025-5889)	11 Jul 202500:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Investigation Assistant app for IBM QRadar SIEM includes components with known vulnerabilities	28 Jul 202513:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security QRadar EDR Software contains multiple vulnerabilities	15 Oct 202512:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to denial of service and path traversal [CVE-2025-47935] [CVE-2025-47944] [CVE-2025-48997] [CVE-2025-48387]	27 Jun 202515:12	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Event Streams	7 Jul 202509:56	–	ibm

Vulners

Node

OR

tar-fs_project tar-fsRange2.0.0–2.1.3

tar-fs_project tar-fsRange3.0.0–3.0.9

tar-fs_project tar-fsRange0.1.0–1.16.5

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-48387
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48387.json
github	www.github.com/google/security-research/security/advisories/GHSA-xrg4-qp5w-2c3w
github	www.github.com/mafintosh/tar-fs/commit/647447b572bc135c41035e82ca7b894f02b17f0f
github	www.github.com/mafintosh/tar-fs
security-tracker	www.security-tracker.debian.org/tracker/CVE-2025-48387
lists	www.lists.debian.org/debian-lts-announce/2025/06/msg00012.html
github	www.github.com/mafintosh/tar-fs/security/advisories/GHSA-8cj5-5rvv-wf4v

07 Oct 2026 02:17Current

CVSS 3.17.5

CVSS 48.7

EPSS0.00576

SSVC

tar-fs tar-stream directory traversal extract write outside directory