GHSA-pq67-2wwv-3xjx: tar-fs fixed in 3.0.7, 2.1.2 and 1.16.4

GHSA-pq67-2wwv-3xjx PUBLISHED CVSS 7.5 HIGH

tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File

Record from GitHub Advisory Database · Published March 27, 2025

tar-fs is fixed in 3.0.7, 2.1.2 and 1.16.4 (npm)

tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
tar-fs	npm	3.0.7, 2.1.2, 1.16.4
kibana-7	Chainguard	7.17.28-r41
code-server	Wolfi	4.105.1-r1
sqlpad	Chainguard	7.5.3-r1
tileserver-gl-fips	Chainguard	5.2.0-r1
sqlpad	Wolfi	7.5.3-r1
code-server	Chainguard	4.105.1-r1
tileserver-gl	Wolfi	5.2.0-r1
tileserver-gl	Chainguard	5.2.0-r1
kibana-8	Chainguard	8.17.4-r41

Risk scores

CVSS 3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

Vendor	Product	Versions
chainguard	kibana-7	0
wolfi	code-server	0
chainguard	sqlpad	0
npm	tar-fs
chainguard	tileserver-gl-fips	0
wolfi	sqlpad	0
chainguard	code-server	0
wolfi	tileserver-gl	0
chainguard	tileserver-gl	0
npm	tar-fs	2.0.0, 0, 3.0.0
chainguard	kibana-8	0

Timeline

Mar 27, 2025 CVE Published
Apr 30, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-pq67-2wwv-3xjx
vulnetix vdb fixes GHSA-pq67-2wwv-3xjx

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-pq67-2wwv-3xjx/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →