tar-fs has issue where extract can write outside the specified dir with a specific tarball
Priority MEDIUM 44CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 4 fixed, 4 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified dir with a specific tarball. This has been patched in versions 3.0.9, 2.1.3, and 1.16.5. As a workaround, use the ignore option to ignore non files/directories.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00579 47th percentileScored 2026-11-07
Fix Partial tar-fs (mafintosh): 1.16.5, 2.1.3, 3.0.9tar-fs (npm): 1.16.5, 2.1.3, 3.0.9Red Hat: 4 advisoriesRed Hat: 4 fixed, 4 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| mafintosh | tar-fs | before 1.16.5; 2.0.0 to before 2.1.3; 3.0.0 to before 3.0.9 | 1.16.5, 2.1.3, 3.0.9 | Patch available | CNA |
| — | tar-fs (npm) | before 1.16.5 | 1.16.5 | Patch available | GHSA-8cj5-5rvv-wf4v |
| — | tar-fs (npm) | 2.0.0 to before 2.1.3 | 2.1.3 | Patch available | GHSA-8cj5-5rvv-wf4v |
| — | tar-fs (npm) | 3.0.0 to before 3.0.9 | 3.0.9 | Patch available | GHSA-8cj5-5rvv-wf4v |
- tar-fs Vendormafintosh Affected before 1.16.5; 2.0.0 to before 2.1.3; 3.0.0 to before 3.0.9 Fixed in 1.16.5, 2.1.3, 3.0.9 Patch available CNA
- tar-fs (npm) Vendor— Affected before 1.16.5 Fixed in 1.16.5 Patch available GHSA-8cj5-5rvv-wf4v
- tar-fs (npm) Vendor— Affected 2.0.0 to before 2.1.3 Fixed in 2.1.3 Patch available GHSA-8cj5-5rvv-wf4v
- tar-fs (npm) Vendor— Affected 3.0.0 to before 3.0.9 Fixed in 3.0.9 Patch available GHSA-8cj5-5rvv-wf4v
Remediation
- Fix · CNA tar-fs (mafintosh) Fixed in 1.16.5, 2.1.3, 3.0.9
- Fix · GHSA-8cj5-5rvv-wf4v tar-fs (npm) Fixed in 1.16.5 Advisory →
- Fix · GHSA-8cj5-5rvv-wf4v tar-fs (npm) Fixed in 2.1.3 Advisory →
- Fix · GHSA-8cj5-5rvv-wf4v tar-fs (npm) Fixed in 3.0.9 Advisory →
Red Hat 4 advisories
- RHSA-2025:15847 Released 2025-09-15 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.23.0 Release.
- Red Hat OpenShift Dev Spaces (RHOSDS) 3.23 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/machineexec-rhel9 +3
- RHSA-2025:14090 Released 2025-08-19 · Red Hat rating ImportantRed Hat Developer Hub 1.7.0 release.
- Red Hat Developer Hub 1.7 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
- RHSA-2025:10992 Released 2025-07-14 · Red Hat rating ImportantRed Hat Developer Hub 1.5.3 release.
- Red Hat Developer Hub 1.5 registry.redhat.io/rhdh/rhdh-hub-rhel9
Show 1 more Red Hat advisories
- RHSA-2025:9966 Released 2025-06-30 · Red Hat rating ImportantRed Hat Developer Hub 1.6.2 release.
- Red Hat Developer Hub 1.6 registry.redhat.io/rhdh/rhdh-hub-rhel9
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Pipelines | Affected | No fix yet |
| OpenShift Serverless | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat Developer Hub 1.5 | Fixed | RHSA-2025:10992 |
| Red Hat Developer Hub 1.6 | Fixed | RHSA-2025:9966 |
| Red Hat Developer Hub 1.7 | Fixed | RHSA-2025:14090 |
| Red Hat OpenShift Dev Spaces (RHOSDS) 3.23 | Fixed | RHSA-2025:15847 |
Not affected: 9 products
- Red Hat Developer Hub 1
- Red Hat Developer Hub 1.5
- Red Hat Developer Hub 1.6
- Red Hat Developer Hub 1.7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Dev Spaces
- Red Hat OpenShift Dev Spaces (RHOSDS) 3.23
Timeline
- 2026-10-02 Threatist record created from CVE-2025-48387
- 2026-10-03 Alias added: GHSA-8cj5-5rvv-wf4v
- 2026-10-27 Affected versions changed · Red Hat
References
Other 5
- https://github.com/mafintosh/tar-fs/security/advisories/GHSA-8cj5-5rvv-wf4v
- https://github.com/google/security-research/security/advisories/GHSA-xrg4-qp5w-2c3w
- https://github.com/mafintosh/tar-fs/commit/647447b572bc135c41035e82ca7b894f02b17f0f
- https://github.com/mafintosh/tar-fs
- https://lists.debian.org/debian-lts-announce/2025/06/msg00012.html
More mafintosh vulnerabilities
- TI-2026-05049 Mafintosh's protocol-buffers-schema is vulnerable to prototype pollution CVSS 3.1MEDIUM 6.5
- TI-2025-36904 tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball CVSS 4.0HIGH 8.7
Sources
- CVE-2025-48387 · CVE Program
- CVE-2025-48387 · NVD
- FIRST EPSS
- GHSA-8cj5-5rvv-wf4v · GitHub Advisory Database · CC BY 4.0
- CVE-2025-48387 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences