mafintosh tar-fs up to 1.16.4/2.1.2/3.0.8 path traversal

Summaryinfo

A vulnerability, which was classified as critical, has been found in mafintosh tar-fs up to 1.16.4/2.1.2/3.0.8. Affected by this vulnerability is an unknown functionality. The manipulation leads to path traversal. This vulnerability is documented as CVE-2025-48387. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in mafintosh tar-fs up to 1.16.4/2.1.2/3.0.8. This issue affects an unknown functionality. The manipulation with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is integrity, and availability. The summary by CVE is:

tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified dir with a specific tarball. This has been patched in versions 3.0.9, 2.1.3, and 1.16.5. As a workaround, use the ignore option to ignore non files/directories.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2025-48387 since 05/19/2025. The exploitation is known to be easy. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1006 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 238247 (Debian dla-4214 : node-tar-fs - security update), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.16.5, 2.1.3 or 3.0.9 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (238247) and EUVD (EUVD-2025-16687). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• mafintosh

Name

• tar-fs

Version

• 1.16.0
• 1.16.1
• 1.16.2
• 1.16.3
• 1.16.4
• 2.1.0
• 2.1.1
• 2.1.2
• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5
• 3.0.6
• 3.0.7
• 3.0.8

Website

• Product: https://github.com/mafintosh/tar-fs/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion