VDB
DEBIAN-CVE-2024-12905
DEBIAN-CVE-2024-12905
PUBLISHED
CVSS 7.5 HIGH
An Improper Link Resolution Before File Access ("Link Following") and Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal"). This vulnerability occurs when extracting a maliciously crafted tar file, which can result in unauthorized file writes or overwrites outside the intended extraction directory. The issue is associated with index.js in the tar-fs package. This issue affects tar-fs: from 0.0.0 before 1.16.4, from 2.0.0 before 2.1.2, from 3.0.0 before 3.0.8.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:11 | node-tar-fs | 2.1.1-4, 2.1.1-3, 2.1.1-4 |
| Debian:14 | node-tar-fs | 0, 0, 0 |
| Debian:12 | node-tar-fs | 2.1.1-6, 0, 0 |
| Debian:13 | node-tar-fs | 0, 0, 0 |
Exploit Intelligence
- tar-fs file write/overwrite vulnerability (github-poc-repo)
- tar-fs file write/overwrite vulnerability (github-poc)
- cve_regression.rs (github-poc)
Timeline
- Mar 27, 2025 CVE Published
- Apr 28, 2026 CVE Updated