Executive brief
tar-fs is a Node.js library for creating and extracting tar archives. A vulnerability allows attackers to write files outside the intended extraction directory when processing a maliciously crafted tar file, potentially overwriting critical system files or application code. This could lead to unauthorized data modification, application compromise, or system-level attacks on any service using tar-fs to extract untrusted archives.
Technical details
The vulnerability is an improper link resolution before file access (CWE-22) and path traversal issue in tar-fs's index.js. When extracting a crafted tar archive, the library fails to properly validate symlinks and sanitize extraction paths, allowing entries with absolute paths or specially crafted names to be written outside the intended target directory. The flaw affects versions 0.0.0–1.16.3, 2.0.0–2.1.1, and 3.0.0–3.0.6. An attacker needs only to provide a malicious tar file to an application that calls tarfs.extract() without strict path validation; no authentication or special privileges are required. Exploitation can result in arbitrary file writes or overwrites. Patches have been released in versions 1.16.4, 2.1.2, and 3.0.7.
Affected products
- tar-fs tar-fs 0.0.0 to <1.16.4; 2.0.0 to <2.1.2; 3.0.0 to <3.0.7
Timeline
- 2025-03-27: disclosed
- 2025-03-27: patched: Patches released in versions 1.16.4, 2.1.2, and 3.0.7