Is CVE-2025-48387 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-48387 being exploited in the wild.

How severe is CVE-2025-48387?

Medium severity, with a CVSS score of 4, published 3 June 2025.

Which products and versions are affected?

tar-fs (npm) SEMVER:introduced=0,fixed=1.16.5.

Is there a fix for CVE-2025-48387?

Yes. tar-fs (npm): upgrade to 1.16.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-48387 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-48387?

Check whether you run tar-fs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-48387: tar-fs directory traversal via crafted symlinks

CVE-2025-48387 · Severity: medium · CVSS 4 · Published 2025-06-03

tar-fs is a Node.js library that extracts tar archives to disk. A vulnerability allows a malicious tarball to write files outside the specified extraction directory by exploiting inadequate symlink validation. An attacker can craft a tar file that creates symlinks and hard links to escape the intended directory boundary and overwrite arbitrary files on the system where the extraction occurs.

Technologies: tar-fs (npm). Vendors: npm.

Quick answers

Is CVE-2025-48387 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-48387 being exploited in the wild.
How severe is CVE-2025-48387?: Medium severity, with a CVSS score of 4, published 3 June 2025.
Which products and versions are affected?: tar-fs (npm) SEMVER:introduced=0,fixed=1.16.5.
Is there a fix for CVE-2025-48387?: Yes. tar-fs (npm): upgrade to 1.16.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-48387 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-48387?: Check whether you run tar-fs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

tar-fs (npm): upgrade to 1.16.5 or later
```
npm install tar-fs@1.16.5
```

Technical details

The vulnerability is a path traversal flaw (CWE-22) in symlink and hardlink handling. The root cause is that tar-fs validates symlink targets using path.resolve() without resolving actual symlinks already present in the filesystem, allowing relative ".." sequences to escape validation. An attacker can craft a tar with nested symlinks (e.g., "noop" linking to ".") and relative paths that chain together to point outside the extraction root. Once a symlink escapes the boundary, hard links can be created through that symlink to overwrite files anywhere on the same filesystem. The attack requires only the ability to provide a malicious tarball to tar-fs's extract() function; no authentication or user interaction is needed beyond calling the vulnerable function. Patches are available in versions 1.16.5, 2.1.3, and 3.0.9.

Affected products

mafintosh tar-fs <1.16.5, <2.1.3, <3.0.9

Identifiers

CVE-2025-48387
GHSA-8cj5-5rvv-wf4v

Timeline

2025-06-02: disclosed: Advisory GHSA-8cj5-5rvv-wf4v published
2025-06-02: patched: Fixed in versions 1.16.5, 2.1.3, 3.0.9
2025-06-03: other: OSV database entry published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.