CVE-2025-59343

What it actually does

tar-fs is a Node.js library used to pack and extract tar archives. Vulnerable versions can be tricked into accepting a crafted tarball that bypasses symlink validation when the extraction destination is predictable. In applications that extract attacker-supplied archives, this can allow files from the archive to be written through a symlink outside the intended extraction directory, causing unauthorized file overwrite or placement. The primary technical impact is high-integrity impact: modification of files the extracting process can write to. Confidentiality and availability impact are not the primary effects, but secondary impact may occur if overwritten files affect application behavior, configuration, scripts, build artifacts, or deployment output.

Why it matters to the business

Systems that accept or process untrusted tar archives may allow an attacker to overwrite files that should be outside the archive extraction area. This can lead to corrupted application data, tampered build or deployment artifacts, altered configuration, or possible follow-on code execution if an overwritten file is later executed or loaded by the application. The vulnerability is not listed in CISA KEV, is not currently associated with ransomware use, has low EPSS likelihood, and has no reported public exploit maturity in the provided data, but it has been public for 319 days, so remediation should be handled as part of normal dependency security maintenance, with higher urgency for services that extract archives from users, CI/CD pipelines, package ingestion systems, backup restore workflows, or file import features.

How an attack unfolds

An attacker first identifies an application or workflow that uses a vulnerable tar-fs version to extract tar archives into a predictable destination directory. The attacker then supplies a specially crafted tarball containing entries that use symlink behavior to evade the library's intended path safety checks. During extraction, tar-fs follows or mishandles the symlink relationship in a way that allows archive content to be written outside the intended extraction root. The attacker aims to overwrite a file writable by the Node.js process, such as configuration, cached content, generated assets, scripts, dependency files, or other application-controlled files. Successful exploitation depends on the application accepting attacker-controlled archives, using a vulnerable tar-fs version, having a predictable extraction path, and running with filesystem permissions that allow the targeted write.

How to fix it

Upgrade tar-fs to a fixed release. For the 3.x line, use version 3.1.1 or later. For the 2.x line, use version 2.1.4 or later based on the advisory text. For the 1.x line, use version 1.16.6 or later based on the advisory text. The provided source repository fix is commit 0aa57de79eb58a5206992c979a7fd5c4df85e07c. Regenerate lockfiles after upgrading and ensure transitive dependencies are updated, not only direct dependencies. Where immediate upgrade is not possible, avoid extracting untrusted tarballs, extract archives only into newly created unpredictable temporary directories, run extraction under a low-privilege account, prevent writes outside a sandboxed workspace, and use the tar-fs ignore option to reject non-file and non-directory entries, including symlinks and other special entries, when they are not required. Add post-extraction validation that canonical resolved paths remain under the intended extraction root.

How to confirm the fix worked

Confirm that all deployed code paths use fixed tar-fs versions by checking package manifests and lockfiles, for example package-lock.json, npm-shrinkwrap.json, yarn.lock, pnpm-lock.yaml, and software composition analysis output. Validate runtime images and packaged artifacts, not only source repositories. Run dependency inspection such as npm ls tar-fs or equivalent tooling and verify no vulnerable 1.x, 2.x, or 3.x versions remain below the fixed releases. Test archive extraction with benign validation archives containing symlinks, absolute paths, parent-directory traversal components, and nested link targets, and confirm extraction rejects unsafe entries or confines all writes to the intended destination. Inspect application configuration to ensure archive extraction occurs in isolated temporary directories with restrictive permissions. Confirm CI/CD and container images were rebuilt after the lockfile update.

Typical attack path

1. Find an application, service, CLI tool, build process, or ingestion pipeline that extracts tar archives using tar-fs.
2. Confirm or infer that the extraction destination is predictable or reused across operations.
3. Prepare a tar archive containing symlink-related entries designed to escape the intended extraction directory.
4. Submit or upload the crafted tarball through the normal archive-processing path.
5. Trigger extraction by the vulnerable application or automation workflow.
6. Cause the extracting process to write attacker-controlled content to a filesystem location outside the intended destination.
7. Use the overwritten file for impact, such as tampering with application behavior, altering configuration, poisoning build artifacts, or setting up a later execution path.

How to detect it

There are no universal network indicators for this vulnerability because exploitation occurs through application-specific archive processing. To assess whether exploitation already occurred, review logs from systems that accept or extract tar archives, including web upload logs, API gateway logs, object storage access logs, application logs, CI/CD job logs, package ingestion logs, container build logs, and file-processing worker logs. Look for archive uploads followed by extraction errors, symlink warnings, path traversal warnings, unexpected writes outside temporary extraction directories, permission-denied errors for sensitive paths, or modifications to configuration, scripts, build outputs, package files, scheduled jobs, or startup files shortly after archive processing. On hosts or containers that process archives, compare file modification times against archive upload/extraction times and investigate files changed outside expected workspaces by the archive-processing account. Review endpoint telemetry for Node.js processes writing to unusual paths, modifying application code or configuration, or spawning unexpected child processes after extraction. If malicious archives are retained, inspect tar metadata for symlink entries, hardlink entries, absolute paths, parent-directory components, or link targets resolving outside the intended extraction root. No named threat actors or ransomware campaigns are provided for this CVE, and no stable public exploit IOC is available from the supplied data.

What your security team should do

• Inventory all applications, build systems, ingestion services, developer tools, and container images that include tar-fs, including transitive dependency usage.
• Prioritize remediation for internet-facing or externally reachable features that accept tar, tgz, npm package, backup, export, plugin, model, dataset, or other archive uploads.
• Upgrade to fixed tar-fs versions and rebuild/redeploy affected artifacts; do not rely solely on updating source repositories.
• Add or verify archive extraction hardening: reject symlinks and special file types unless explicitly required, canonicalize paths, use unpredictable temporary directories, and enforce least-privilege filesystem permissions.
• Search recent application, upload, and extraction logs for suspicious archive submissions, symlink-heavy tarballs, extraction errors, and unexpected file writes outside extraction workspaces.
• Add regression tests for path traversal and symlink archive cases so future dependency or extraction-code changes do not reintroduce the weakness.
• Because this is not KEV-listed and has low EPSS in the provided data, handle as a dependency hygiene issue unless the organization processes untrusted archives, in which case treat it as high priority.