Riskcovery

CVE-2024-12905

State
Published
Severity
7.5 High
Published
Mar 27, 2025
Updated
Nov 3, 2025
Reserved
Dec 23, 2024

Read the record on cve.org

Description

An Improper Link Resolution Before File Access ("Link Following") and Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal"). This vulnerability occurs when extracting a maliciously crafted tar file, which can result in unauthorized file writes or overwrites outside the intended extraction directory. The issue is associated with index.js in the tar-fs package.

This issue affects tar-fs: from 0.0.0 before 1.16.4, from 2.0.0 before 2.1.2, from 3.0.0 before 3.0.8.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nseal

Weaknesses

  • CWE-59 Improper Link Resolution Before File Access ('Link Following')
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

ProductVersions
tar-fs
  • 0.0.0 to before 1.16.4Affectedfrom 1.16.4Not affected
  • 2.0.0 to before 2.1.2Affectedfrom 2.1.2Not affected
  • 3.0.0 to before 3.0.8Affectedfrom 3.0.8Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.