tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball
Priority LOW 38CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 11 fixed, 10 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.1.1, 2.1.3, and 1.16.5 are vulnerable to symlink validation bypass if the destination directory is predictable with a specific tarball. This issue has been patched in version 3.1.1, 2.1.4, and 1.16.6. A workaround involves using the ignore option on non files/directories.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0058 47th percentileScored 2026-11-07
Fix Partial tar-fs (mafintosh): 3.1.1, 2.1.3, 1.16.5tar-fs (npm): 3.1.1, 2.1.4, 1.16.6Red Hat: 10 advisoriesRed Hat: 11 fixed, 10 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| mafintosh | tar-fs | 3.0.0 to before 3.1.1; 2.0.0 to before 2.1.3; before 1.16.5 | 3.1.1, 2.1.3, 1.16.5 | Patch available | CNA |
| — | tar-fs (npm) | 3.0.0 to before 3.1.1 | 3.1.1 | Patch available | GHSA-vj76-c3g6-qr5v |
| — | tar-fs (npm) | 2.0.0 to before 2.1.4 | 2.1.4 | Patch available | GHSA-vj76-c3g6-qr5v |
| — | tar-fs (npm) | before 1.16.6 | 1.16.6 | Patch available | GHSA-vj76-c3g6-qr5v |
- tar-fs Vendormafintosh Affected 3.0.0 to before 3.1.1; 2.0.0 to before 2.1.3; before 1.16.5 Fixed in 3.1.1, 2.1.3, 1.16.5 Patch available CNA
- tar-fs (npm) Vendor— Affected 3.0.0 to before 3.1.1 Fixed in 3.1.1 Patch available GHSA-vj76-c3g6-qr5v
- tar-fs (npm) Vendor— Affected 2.0.0 to before 2.1.4 Fixed in 2.1.4 Patch available GHSA-vj76-c3g6-qr5v
- tar-fs (npm) Vendor— Affected before 1.16.6 Fixed in 1.16.6 Patch available GHSA-vj76-c3g6-qr5v
Remediation
- Fix · CNA tar-fs (mafintosh) Fixed in 3.1.1, 2.1.3, 1.16.5
- Fix · GHSA-vj76-c3g6-qr5v tar-fs (npm) Fixed in 3.1.1 Advisory →
- Fix · GHSA-vj76-c3g6-qr5v tar-fs (npm) Fixed in 2.1.4 Advisory →
- Fix · GHSA-vj76-c3g6-qr5v tar-fs (npm) Fixed in 1.16.6 Advisory →
Red Hat 10 advisories
- RHSA-2026:86618 Released 2026-10-21 · Red Hat rating CriticalNew container image: rhceph-9.2
- Red Hat Ceph Storage 9.2 registry.redhat.io/rhceph/rhceph-9-rhel10
- RHSA-2026:33154 Released 2026-06-29 · Red Hat rating ImportantRed Hat Ceph Storage
- Red Hat Ceph Storage 7.1 registry.redhat.io/rhceph/grafana-rhel9, registry.redhat.io/rhceph/rhceph-7-rhel9
- RHSA-2026:26411 Released 2026-06-16 · Red Hat rating ImportantNew container image: rhceph-9.0
- Red Hat Ceph Storage 9.0 registry.redhat.io/rhceph/grafana-rhel10, registry.redhat.io/rhceph/rhceph-9-rhel9
Show 7 more Red Hat advisories
- RHSA-2026:6226 Released 2026-03-31 · Red Hat rating ImportantMulticluster Global Hub 1.6.2 security update
- Multicluster Global Hub 1.6.6 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +2
- RHSA-2025:19529 Released 2025-11-03 · Red Hat rating ImportantRed Hat Developer Hub 1.7.2 release.
- Red Hat Developer Hub 1.7 registry.redhat.io/rhdh/rhdh-hub-rhel9
- RHSA-2025:19221 Released 2025-10-28 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.6 Container Release Update
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-26/gateway-rhel9, registry.redhat.io/ansible-automation-platform-26/lightspeed-rhel9
- RHSA-2025:19201 Released 2025-10-28 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-eda-controller-1.2.1-1.el9ap, automation-eda-controller-base-1.2.1-1.el9ap, automation-eda-controller-base-services-1.2.1-1.el9ap +4
- RHSA-2025:19094 Released 2025-10-23 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.24.0 Release.
- Red Hat OpenShift Dev Spaces (RHOSDS) 3.24 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/openvsx-rhel9 +4
- RHSA-2025:18979 Released 2025-10-22 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-gateway-2.5.20251022-1.el8ap, automation-gateway-config-2.5.20251022-1.el8ap, automation-gateway-server-2.5.20251022-1.el8ap +1
- Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-gateway-2.5.20251022-1.el9ap, automation-gateway-config-2.5.20251022-1.el9ap, automation-gateway-server-2.5.20251022-1.el9ap +1
- RHSA-2025:17376 Released 2025-10-06 · Red Hat rating ImportantRed Hat build of Cryostat 4.0.3: new RHEL 9 container image security update
- Cryostat 4 on RHEL 9 cryostat/cryostat-agent-init-rhel9, cryostat/cryostat-db-rhel9, cryostat/cryostat-grafana-dashboard-rhel9 +8
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cryostat 4 | Affected | No fix yet |
| Node HealthCheck Operator | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet |
| Red Hat Ceph Storage 6 | Affected | No fix yet |
| Red Hat Ceph Storage 7 | Affected | No fix yet |
| Red Hat Ceph Storage 8 | Affected | No fix yet |
| Red Hat Ceph Storage 9 | Affected | No fix yet |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Cryostat 4 on RHEL 9 | Fixed | RHSA-2025:17376 |
| Multicluster Global Hub 1.6.6 | Fixed | RHSA-2026:6226 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | Fixed | RHSA-2025:18979 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | Fixed | RHSA-2025:18979 |
| Red Hat Ansible Automation Platform 2.6 | Fixed | RHSA-2025:19221 |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | Fixed | RHSA-2025:19201 |
| Red Hat Ceph Storage 7.1 | Fixed | RHSA-2026:33154 |
| Red Hat Ceph Storage 9.0 | Fixed | RHSA-2026:26411 |
| Red Hat Ceph Storage 9.2 | Fixed | RHSA-2026:86618 |
| Red Hat Developer Hub 1.7 | Fixed | RHSA-2025:19529 |
| Red Hat OpenShift Dev Spaces (RHOSDS) 3.24 | Fixed | RHSA-2025:19094 |
Not affected: 19 products
- Logging Subsystem for Red Hat OpenShift
- Multicluster Engine for Kubernetes
- Multicluster Global Hub 1.6.6
- Node HealthCheck Operator
- OpenShift Serverless
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Red Hat Ansible Automation Platform 2.6
- Red Hat Ansible Automation Platform 2.6 for RHEL 9
- Red Hat Ceph Storage 7.1
- Red Hat Ceph Storage 9.0
- Red Hat Ceph Storage 9.2
- Red Hat Developer Hub 1.7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift Dev Spaces
- Red Hat OpenShift Dev Spaces (RHOSDS) 3.24
- Red Hat Openshift Data Foundation 4
Timeline
- 2026-10-02 Threatist record created from CVE-2025-59343
- 2026-10-03 Alias added: GHSA-vj76-c3g6-qr5v
- 2026-10-21 Fix available: RHSA-2026:86618 · Red Hat
- 2026-10-21 Fix available: Multicluster Global Hub 1.6.6, Red Hat Ceph Storage 9.2 · Red Hat
References
More mafintosh vulnerabilities
- TI-2026-05049 Mafintosh's protocol-buffers-schema is vulnerable to prototype pollution CVSS 3.1MEDIUM 6.5
- TI-2025-30712 tar-fs has issue where extract can write outside the specified dir with a specific tarball CVSS 4.0HIGH 8.7
Sources
- CVE-2025-59343 · CVE Program
- CVE-2025-59343 · NVD
- FIRST EPSS
- GHSA-vj76-c3g6-qr5v · GitHub Advisory Database · CC BY 4.0
- CVE-2025-59343 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences