CVE-2024-12905-PoC

CVE-2024-12905 tar-fs file write/overwrite vulnerability...

CVE-2024-42471-PoC

CVE-2024-42471-PoC tar-fs file write/overwrite vulnerability...

CLSA-2026-1790963499 TuxCare security update for tar-fs (3 CVEs)

TuxCare rebuilt tar-fs to address 3 CVEs. Fixed in 2.1.1-tuxcare.1...

CLSA-2026-1788560472 TuxCare security update for tar-fs (3 CVEs)

TuxCare rebuilt tar-fs to address 3 CVEs. Fixed in 3.0.4-tuxcare.1...

PT-2026-91823

TuxCare rebuilt tar-fs to address 3 CVEs. Fixed in 3.0.4-tuxcare.1...

ROOT-APP-NPM-CVE-2025-59343 CVE-2025-59343 in tar-fs - Patched by Root

Root has patched CVE-2025-59343 in the tar-fs package for Root:npm. Multiple fixed versions available...

CLSA-2026-1774484497 TuxCare security update for tar-fs (5 CVEs)

TuxCare rebuilt tar-fs to address 5 CVEs. Fixed in 1.5.1-tuxcare.1...

PT-2026-74131

TuxCare rebuilt tar-fs to address 5 CVEs. Fixed in 1.5.1-tuxcare.1...

ROOT-APP-NPM-CVE-2025-48387 CVE-2025-48387 in tar-fs - Patched by Root

Root has patched CVE-2025-48387 in the tar-fs package for Root:npm. Multiple fixed versions available...

Ubuntu 22.04 LTS / 24.04 LTS / 25.10 : tar-fs vulnerabilities (USN-8367-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8367-1 advisory. It was discovered that tar-fs did not properly limit paths when extracting crafted tar files. An attacker could possibly use this iss...

USN-8367-1 node-tar-fs vulnerabilities

It was discovered that tar-fs did not properly limit paths when extracting crafted tar files. An attacker could possibly use this issue to write or overwrite files outside the intended extraction directory. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. CVE-2024-12905 It was...

Security Bulletin: IBM Langflow Desktop Symlink Validation Bypass

Summary tar-fs is used by IBM Langflow Desktop as part of its archive extraction and file handling functionality through Node.js dependencies. A vulnerability in tar-fs affects how symbolic links are validated during extraction, allowing a crafted tarball to bypass symlink protections when the...

tar-fs Package Data Compromise

The vulnerability of the tar-fs package from the tar-stream library relates to an incorrect pathname limitation for the restricted-access directory. Exploiting this vulnerability could allow a remote attacker to compromise the integrity of the protected information...

Security Bulletin: Vulnerabilities in tar-fs-2.1.1.tgz affecting MongoDB Enterprised Advanced (CVE-2025-59343)

Summary There is a vulnerability in tar-fs-2.1.1.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2025-59343. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2025-59343 DESCRIPTION: tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.1.1,...

Atlassian Confluence 7.19.x < 8.5.10 / 8.6.x < 9.2.5 / 9.3.x < 9.3.1 / 9.4.x < 9.5.1 / 10.0.2 / 10.1.0 / 10.2.0 (CONFSERVER-101930)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-101930 advisory. - tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.1.1, 2.1.3, and 1.16.5 are vulnerable to symlink validation bypass if the...

Atlassian Confluence 7.19.0 < 8.5.10 / 8.6.x < 9.2.5 / 9.3.x < 9.3.1 / 9.4.x < 9.5.1 / 10.0.x < 10.0.2 / 10.1.0 / 10.2.0 (CONFSERVER-101478)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-101478 advisory. - An Improper Link Resolution Before File Access Link Following and Improper Limitation of a Pathname to a Restricted Directory Path Traversal. Thi...

Security Bulletin: IBM Maximo Application Suite - Monitor Component uses tar-fs-2.1.3.tgz which is vulnerable to CVE-2025-59343.

Summary IBM Maximo Application Suite - Monitor Component uses tar-fs-2.1.3.tgz which is vulnerable to CVE-2025-59343. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2025-59343 DESCRIPTION: tar-fs provides filesystem bindings for...

Security Bulletin: Astronomer with IBM is vulnerable to symlink validation bypass due to the tar-fs package (CVE-2025-59343)

Summary Tar-fs is used by Astronomer with IBM as part of tar file processing functionality. Vulnerability Details CVEID:CVE-2025-59343 DESCRIPTION: tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.1.1, 2.1.3, and 1.16.5 are vulnerable to symlink validation bypass if the...

Security Bulletin: Astronomer with IBM is vulnerable to unrestricted filesystem writes due to the tar-fs package (CVE-2025-48387)

Summary Tar-fs is used by Astronomer with IBM as part of tar file processing. Vulnerability Details CVEID:CVE-2025-48387 DESCRIPTION: tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified dir...

tar-fs Symbolic Link Access

The vulnerability of the tar-fs module for working with tar archives is related to an incorrect definition of symbolic links before accessing the file. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...