Skip to content
Fencer Vulns
high 7.5

CVE-2024-12905 json

tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File

published 2025-03-27 19 mo ago modified 2026-09-10 1 mo ago also GHSA-pq67-2wwv-3xjx , EUVD-2024-54315

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.3%
EPSS 2.3% chance of exploitation in 30 days, percentile 83%
public exploits
1
Exploit-DB

Summary

An Improper Link Resolution Before File Access ("Link Following") and Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal"). This vulnerability occurs when extracting a maliciously crafted tar file, which can result in unauthorized file writes or overwrites outside the intended extraction directory. The issue is associated with index.js in the tar-fs package.

This issue affects tar-fs: from 0.0.0 before 1.16.4, from 2.0.0 before 2.1.2, from 3.0.0 before 3.0.8.

Patch / fix

  • npm tar-fs 1.16.4, 2.1.2, 3.0.7
  • node-tar-fs Debian 12 2.1.3-0+deb12u1
  • node-tar-fs Debian 14, Debian 13 3.0.8+~cs2.0.4-1

debian advisories DEBIAN-CVE-2024-12905

  • node-tar-fs Ubuntu Pro 22.04 LTS 2.1.1-6ubuntu0.22.04.1~esm1
  • node-tar-fs Ubuntu Pro 24.04 LTS 2.1.1-6ubuntu0.24.04.1~esm1

ubuntu advisories UBUNTU-CVE-2024-12905

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • reaper CBL-Mariner 2.0 3.1.1-18

azure linux advisories AZL-59367

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-12905 updated cvss 7.5

tar-fs: link following and path traversal via maliciously crafted tar file

  • Red Hat Ceph Storage 7 ceph, cephadm, librbd1, librgw2, rbd-nbd, ceph-mib, +16 more Red Hat Ceph Storage 8 ceph, cephadm, librbd1, librgw2, rbd-nbd, ceph-mib, +17 more Red Hat Ceph Storage 9 ceph, cephadm, librbd1, librgw2, rbd-nbd, ceph-mib, +17 more
    affected: no fix available
  • Red Hat Ceph Storage 7.1 rhceph/rhceph-7-rhel9 1781863705
    fixed: vendor fix RHSA-2026:33154
  • Red Hat Developer Hub 1.5 rhdh 1.5.2-1748495853
    fixed: vendor fix RHSA-2025:8540
  • Red Hat Developer Hub 1.6 rhdh 1.6.0-1745956724
    fixed: vendor fix RHSA-2025:7626
  • Red Hat OpenShift Dev Spaces 3 devspaces/udi-rhel9 3.21-6, devspaces/code-rhel9 3.21-5, devspaces/server-rhel9 3.21-11, devspaces/traefik-rhel9 3.21-1, devspaces/udi-base-rhel9 3.21-2, devspaces/configbump-rhel9 3.21-5, +9 more
    fixed: vendor fix RHSA-2025:8244
  • Red Hat Ceph Storage 7.1 rhceph/grafana-rhel9 1781855851, rhceph/keepalived-rhel9 1781855108, rhceph/snmp-notifier-rhel9 1781854814, rhceph/rhceph-haproxy-rhel9 1781856344, rhceph/rhceph-promtail-rhel9 1781856148 Red Hat Developer Hub 1.5 rhdh 1.5.2-1748493879, rhdh 1.5.2-1748873060 Red Hat Developer Hub 1.6 rhdh 1.6.0-1745956395, rhdh 1.6.0-1745970106 Red Hat OpenShift Dev Spaces 3 devspaces/udi-rhel9 3.20-8, devspaces/code-rhel9 3.20-5, devspaces/server-rhel9 3.20-13, devspaces/traefik-rhel9 3.20-1, devspaces/udi-base-rhel9 3.20-1, devspaces/dashboard-rhel9 3.20-7, +7 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. Published
  2. First public exploit (EDB-52268)

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
19 mo ago

Exploit prediction

2.30% chance of exploitation in the next 30 days, higher than 83% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-52268 tar-fs 3.0.0 - Arbitrary File Write/Overwrite local, 2025-04-22

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem package affected fixed in
npm tar-fs
<1.16.4
>=2.0.0, <2.1.2
>=3.0.0, <3.0.7
1.16.4
2.1.2
3.0.7

Classification

Weakness
  • CWE-59 Improper Link Resolution Before File Access
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.