CVE-2026-31802

CVE-2026-31802：tar 符号链接路径遍历 / 任意文件覆盖 研究： Joshua van Rijswijk 描述 本仓库包含我针对 CVE-2026-31802 的概念验证和漏洞分析报告，这是 npm tar 包（node-tar）中的一个高危漏洞，影响版本 = 7.5.10。 我发现，通过使用驱动器相对 符号链接目标（例如 C:../../../target.txt），可以诱使 tar 创建指向预期解压目录之外的符号链接。实际上，这使得在解压过程中能够逃逸 cwd，并将归档解压转变为任意文件覆盖原语 。 该漏洞可通过正常解压行为，配合攻击者控制的 tar 归档来触发。 背...

CVE-2026-31802 node-tar Symlink Path Traversal via Drive-Relative Linkpath

node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar npm can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as C:../../../target.txt, which enables file overwrite outside cwd during normal tar.x...

AZL-79553 CVE-2026-29786 affecting package tar 1.35-2

node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x extraction. Th...

CVE-2026-29786 node-tar: Hardlink Path Traversal via Drive-Relative Linkpath

node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x extraction. Th...