# CVE-2025-59343: tar-fs symlink validation bypass with predictable destination

Source: https://junglewise.ai/threats/cve-2025-59343-tar-fs-symlink-validation-bypass-with-predictable-destination  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-09-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-59343 · Severity: medium · CVSS 4 · Published 2025-09-24

tar-fs is a Node.js library used to extract and package tar archives. A symlink validation weakness allows attackers to bypass security checks when extracting specially crafted tar files to a predictable directory, potentially leading to unauthorized file writes or directory traversal attacks. This could allow an attacker to write files outside the intended extraction location.

Technologies: [tar-fs (npm)](https://junglewise.ai/threats/technologies/tar-fs). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-59343 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-59343 being exploited in the wild.

**How severe is CVE-2025-59343?** Medium severity, with a CVSS score of 4, published 24 September 2025.

**Which products and versions are affected?** tar-fs (npm) SEMVER:introduced=3.0.0,fixed=3.1.1.

**Is there a fix for CVE-2025-59343?** Yes. tar-fs (npm): upgrade to 3.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-59343 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-59343?** Check whether you run tar-fs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- tar-fs (npm): upgrade to 3.1.1 or later

  ```sh
  npm install tar-fs@3.1.1
  ```


## Technical details

tar-fs contains a symlink validation bypass (CWE-22: Path Traversal, CWE-61: Symlink Following) in versions 3.1.0 and earlier, 2.1.3 and earlier, and 1.16.5 and earlier. An attacker can craft a specific tarball that, when extracted to a predictable destination directory, bypasses symlink validation controls. The attack requires control over the tarball content and knowledge of the extraction destination path, but does not require authentication or special privileges. Successful exploitation allows writing files outside the intended extraction directory. The vulnerability has been patched in versions 3.1.1, 2.1.4, and 1.16.6. A workaround is available using the ignore option to filter out symlinks during extraction.

## Affected products

- tar-fs tar-fs <1.16.6, <2.1.4, <3.1.1

## Identifiers

- CVE-2025-59343
- GHSA-vj76-c3g6-qr5v

## Timeline

- 2025-09-24: disclosed
- 2025-09-24: patched: Patched in versions 3.1.1, 2.1.4, and 1.16.6

## References

- [https://github.com/mafintosh/tar-fs/security/advisories/GHSA-vj76-c3g6-qr5v](https://github.com/mafintosh/tar-fs/security/advisories/GHSA-vj76-c3g6-qr5v)

## Related threats

- [tar-fs directory traversal via crafted symlinks](https://junglewise.ai/threats/cve-2025-48387-tar-fs-directory-traversal-via-crafted-symlinks)
- [tar-fs path traversal and symlink following in extraction](https://junglewise.ai/threats/cve-2024-12905-tar-fs-path-traversal-and-symlink-following-in-extraction)
- [tar-fs improper input validation in hardlink extraction](https://junglewise.ai/threats/cve-2018-20835-tar-fs-improper-input-validation-in-hardlink-extraction)