CVE-2025-59343
BaseFortify
Publication date: 2025-09-24
Last updated on: 2025-11-03
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mafintosh | tar-fs | * |
| node-tar-fs | node-tar-fs | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
| CWE-61 | The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in tar-fs affects versions prior to 3.1.1, 2.1.3, and 1.16.5, where symlink validation can be bypassed if the destination directory is predictable with a specific tarball. This means an attacker could potentially exploit this to create or manipulate symbolic links in unintended ways during extraction, leading to security issues. The problem has been fixed in later versions 3.1.1, 2.1.4, and 1.16.6.
How can this vulnerability impact me? :
The vulnerability can allow an attacker to bypass symlink validation, potentially leading to unauthorized file access or modification when extracting tarballs. This could result in security breaches such as overwriting critical files or executing malicious code, depending on the context in which tar-fs is used.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update tar-fs to version 3.1.1, 2.1.4, or 1.16.6 or later. As a workaround, use the ignore option on non files/directories when processing tarballs.