# CVE-2025-48387: tar-fs directory traversal via crafted symlinks

Source: https://junglewise.ai/threats/cve-2025-48387-tar-fs-directory-traversal-via-crafted-symlinks  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-06-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-48387 · Severity: medium · CVSS 4 · Published 2025-06-03

tar-fs is a Node.js library that extracts tar archives to disk. A vulnerability allows a malicious tarball to write files outside the specified extraction directory by exploiting inadequate symlink validation. An attacker can craft a tar file that creates symlinks and hard links to escape the intended directory boundary and overwrite arbitrary files on the system where the extraction occurs.

Technologies: [tar-fs (npm)](https://junglewise.ai/threats/technologies/tar-fs). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-48387 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-48387 being exploited in the wild.

**How severe is CVE-2025-48387?** Medium severity, with a CVSS score of 4, published 3 June 2025.

**Which products and versions are affected?** tar-fs (npm) SEMVER:introduced=0,fixed=1.16.5.

**Is there a fix for CVE-2025-48387?** Yes. tar-fs (npm): upgrade to 1.16.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-48387 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-48387?** Check whether you run tar-fs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- tar-fs (npm): upgrade to 1.16.5 or later

  ```sh
  npm install tar-fs@1.16.5
  ```


## Technical details

The vulnerability is a path traversal flaw (CWE-22) in symlink and hardlink handling. The root cause is that tar-fs validates symlink targets using path.resolve() without resolving actual symlinks already present in the filesystem, allowing relative ".." sequences to escape validation. An attacker can craft a tar with nested symlinks (e.g., "noop" linking to ".") and relative paths that chain together to point outside the extraction root. Once a symlink escapes the boundary, hard links can be created through that symlink to overwrite files anywhere on the same filesystem. The attack requires only the ability to provide a malicious tarball to tar-fs's extract() function; no authentication or user interaction is needed beyond calling the vulnerable function. Patches are available in versions 1.16.5, 2.1.3, and 3.0.9.

## Affected products

- mafintosh tar-fs <1.16.5, <2.1.3, <3.0.9

## Identifiers

- CVE-2025-48387
- GHSA-8cj5-5rvv-wf4v

## Timeline

- 2025-06-02: disclosed: Advisory GHSA-8cj5-5rvv-wf4v published
- 2025-06-02: patched: Fixed in versions 1.16.5, 2.1.3, 3.0.9
- 2025-06-03: other: OSV database entry published

## References

- [https://github.com/google/security-research/security/advisories/GHSA-xrg4-qp5w-2c3w](https://github.com/google/security-research/security/advisories/GHSA-xrg4-qp5w-2c3w)
- [https://github.com/mafintosh/tar-fs/security/advisories/GHSA-8cj5-5rvv-wf4v](https://github.com/mafintosh/tar-fs/security/advisories/GHSA-8cj5-5rvv-wf4v)

## Related threats

- [tar-fs symlink validation bypass with predictable destination](https://junglewise.ai/threats/cve-2025-59343-tar-fs-symlink-validation-bypass-with-predictable-destination)
- [tar-fs path traversal and symlink following in extraction](https://junglewise.ai/threats/cve-2024-12905-tar-fs-path-traversal-and-symlink-following-in-extraction)
- [tar-fs improper input validation in hardlink extraction](https://junglewise.ai/threats/cve-2018-20835-tar-fs-improper-input-validation-in-hardlink-extraction)