Vulnerability · Published Mar 27, 2025 · Assigned by seal
CVE-2024-12905
High 7.5
In plain English
A high-severity path traversal in tar-fs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 83% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
An Improper Link Resolution Before File Access ("Link Following") and Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal"). This vulnerability occurs when extracting a maliciously crafted tar file, which can result in unauthorized file writes or overwrites outside the intended extraction directory. The issue is associated with index.js in the tar-fs package. This issue affects tar-fs: from 0.0.0 before 1.16.4, from 2.0.0 before 2.1.2, from 3.0.0 before 3.0.8.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | node-tar-fs | 2.1.3-0+deb12u1 | DEBIAN-CVE-2024-12905 |
| Debian:13 | node-tar-fs | 3.0.8+~cs2.0.4-1 | DEBIAN-CVE-2024-12905 |
| Debian:14 | node-tar-fs | 3.0.8+~cs2.0.4-1 | DEBIAN-CVE-2024-12905 |
| Ubuntu:25.10 | node-tar-fs | 3.0.9+~cs2.0.4-1+deb13u1build0.25.10.1 | USN-8367-1 |
| npm | tar-fs | 3.0.7 | GHSA-pq67-2wwv-3xjx |
| npm | tar-fs | 1.16.4 | GHSA-pq67-2wwv-3xjx |
| npm | tar-fs | 2.1.2 | GHSA-pq67-2wwv-3xjx |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| tar-fs | 0.0.0 – before 1.16.42.0.0 – before 2.1.23.0.0 – before 3.0.8 |
Weakness: CWE-59, CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N