> CVE-2025-48387

« BACK_TO_HOME
PUBLISHED
2025-06-02 20:15
MODIFIED
2025-08-14 20:15
EPSS (Prob. Exploit)
0.58%
Top 53.2%
DATA SOURCES:
NVD 🔗 2025-10-18 RED HAT 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-11-04 OSV 🔗 2026-03-01 MSRC 🔗 2026-05-01

> DESCRIPTION

tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified dir with a specific tarball. This has been patched in versions 3.0.9, 2.1.3, and 1.16.5. As a workaround, use the ignore option to ignore non files/directories.

> AFFECTED_PRODUCTS

Red Hat - Red Hat Developer Hub 1.6
Red Hat - Red Hat Developer Hub 1.7
Red Hat - Red Hat Developer Hub 1.5

> RED HAT SECURITY ADVISORIES

Red Hat Security Advisory: Red Hat Developer Hub 1.7.0 release.
Red Hat Developer Hub 1.7.0 has been released.
Red Hat Security Advisory: Red Hat Developer Hub 1.5.3 release.
Red Hat Developer Hub 1.5.3 has been released.
Red Hat Security Advisory: Red Hat Developer Hub 1.6.2 release.
Red Hat Developer Hub 1.6.2 has been released.

> RED HAT SEVERITY ASSESSMENT

THREAT SEVERITY
Important

> GITHUB SECURITY ADVISORY

GHSA-8cj5-5rvv-wf4v HIGH

tar-fs can extract outside the specified dir with a specific tarball

AFFECTED PACKAGES:
NPM / tar-fs
>= 3.0.0, < 3.0.9
Fixed in: 3.0.9
NPM / tar-fs
>= 2.0.0, < 2.1.3
Fixed in: 2.1.3
NPM / tar-fs
< 1.16.5
Fixed in: 1.16.5

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

tar-fs has issue where extract can write outside the specified dir with a specific tarball

AFFECTED PACKAGES:
Unknown / Unknown
65 versions affected
ALIASES:
GHSA-8cj5-5rvv-wf4v

> HISTORIQUE DES MODIFICATIONS

Première apparition
02/06/2025 20:15
Source: NVD
📊 ENRICHISSEMENT 18/10/2025 15:04
CVEPROJECT
Champ modifié: CVE Project
Ancienne valeur:
Non
Nouvelle valeur:
Oui
📊 ENRICHISSEMENT 18/10/2025 12:14
REDHAT
Champ modifié: Sévérité Red Hat
Ancienne valeur:
N/A
Nouvelle valeur:
{ "threat_severity": "Important", "severity_scale": null }
📊 ENRICHISSEMENT 18/10/2025 12:14
REDHAT
Champ modifié: Red Hat
Ancienne valeur:
Non
Nouvelle valeur:
Oui
Total des modifications: 3 Dernière mise à jour: 1 year ago
« BACK_TO_HOME