|
Vulnerabilities
< Back

CVE-2025-59343

Updated on 24 Sep 2025

Severity

Awaiting Analysis

Details

CVSS score
8.6
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.1.1, 2.1.3, and 1.16.5 are vulnerable to symlink validation bypass if the destination directory is predictable with a specific tarball. This issue has been patched in version 3.1.1, 2.1.4, and 1.16.6. A workaround involves using the ignore option on non files/directories.

Details

Affected product:
tar-fs
Affected packages:
tar-fs @ 1.5.1
tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.1.1, 2.1.3, and 1.16.5 are vulnerable to symlink validation bypass if the destination directory is predictable with a specific tarball. This issue has been patched in version 3.1.1, 2.1.4, and 1.16.6. A workaround involves using the ignore option on non files/directories.

Fixes