CVE-2025-48387
tar-fs has issue where extract can write outside the specified dir with a specific tarball
Reported by github_m · Published June 2, 2025
tar-fs is fixed in 3.0.9, 2.1.3 and 1.16.5 (npm)
tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified dir with a specific tarball. This has been patched in versions 3.0.9, 2.1.3, and 1.16.5. As a workaround, use the ignore option to ignore non files/directories.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| tar-fs | npm | 3.0.9, 2.1.3, 1.16.5 |
| code-server | Wolfi | 4.105.1-r1 |
| code-server | Chainguard | 4.105.1-r1 |
| tileserver-gl | Chainguard | 5.3.1-r3 |
| tileserver-gl-fips | Chainguard | 5.3.1-r2 |
| sqlpad | Wolfi | 7.5.3-r2 |
| gitlab-rails-ce-fips-19.0 | Chainguard | 19.0.9-r3 |
| gitlab-rails-ce-fips-18.9 | Chainguard | 18.9.8-r8 |
| gitlab-rails-ce-19.2 | Chainguard | 19.2.5-r2 |
| gitlab-rails-ce-fips-18.1 | Chainguard | 18.1.6-r15 |
| gitlab-rails-ce-19.1 | Chainguard | 19.1.7-r6 |
| gitlab-rails-ce-19.3 | Chainguard | 19.3.1-r6 |
7 more packages have a fixed version. See every fix in Lookup.
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| mafintosh | tar-fs | < 1.16.5, >= 2.0.0, < 2.1.3, >= 3.0.0, < 3.0.9 |
| wolfi | code-server | 0 |
| chainguard | code-server | 0 |
| chainguard | tileserver-gl | 0 |
| chainguard | tileserver-gl-fips | 0 |
| wolfi | sqlpad | 0 |
| chainguard | gitlab-rails-ce-fips-19.0 | 0 |
| chainguard | gitlab-rails-ce-fips-18.9 | 0 |
| chainguard | gitlab-rails-ce-19.2 | 0 |
| chainguard | gitlab-rails-ce-fips-18.1 | 0 |
| chainguard | gitlab-rails-ce-19.1 | 0 |
| chainguard | gitlab-rails-ce-19.3 | 0 |
| chainguard | jitsucom-jitsu | 0 |
| chainguard | sqlpad | 0 |
| chainguard | gitlab-rails-ce-fips-18.10 | 0 |
| npm | tar-fs | 0, 3.0.0, 2.0.0 |
| chainguard | kibana-7 | 0 |
| chainguard | gitlab-rails-ce-fips-19.1 | 0 |
| wolfi | tileserver-gl | 0 |
| wolfi | jitsucom-jitsu | 0 |
…and 4 more
Timeline
- Jun 2, 2025 CVE Published
- Jun 3, 2025 EPSS Score (30 in total, the first dated here)
- Mar 10, 2026 Security Advisory
- Apr 18, 2026 PoC Published
- Jun 6, 2026 Coalition ESS Score
- Jun 17, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2025-48387
vulnetix vdb fixes CVE-2025-48387Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-48387/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/mafintosh/tar-fs/security/advisories/GHSA-8cj5-5rvv-wf4v x_refsource_CONFIRM
- https://github.com/google/security-research/security/advisories/GHSA-xrg4-qp5w-2c3w x_refsource_MISC
- https://github.com/mafintosh/tar-fs/commit/647447b572bc135c41035e82ca7b894f02b17f0f x_refsource_MISC
- https://lists.debian.org/debian-lts-announce/2025/06/msg00012.html url
- https://nvd.nist.gov/vuln/detail/CVE-2025-48387 advisory
- https://github.com/advisories/GHSA-8cj5-5rvv-wf4v advisory
- https://github.com/mafintosh/tar-fs url