CVE catalog
CVE-2024-12905
tar-fs vulnerabilities
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 2.30% · Oct 25, 2026
An Improper Link Resolution Before File Access ("Link Following") and Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal"). This vulnerability occurs when extracting a maliciously crafted tar file, which can result in unauthorized file writes or overwrites outside the intended extraction directory. The issue is associated with index.js in the tar-fs package. This issue affects tar-fs: from 0.0.0 before 1.16.4, from 2.0.0 before 2.1.2, from 3.0.0 before 3.0.8.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | node-tar-fs | sid | 3.1.2+~cs2.0.4-1 | fixed |
| Debian | node-tar-fs | forky | 3.1.2+~cs2.0.4-1 | fixed |
| Debian | node-tar-fs | trixie | 3.0.9+~cs2.0.4-1+deb13u1 | fixed |
| Debian | node-tar-fs | trixie-security | 3.0.9+~cs2.0.4-1+deb13u1 | fixed |
| Debian | node-tar-fs | bookworm | 2.1.3-0+deb12u2 | fixed |
| Debian | node-tar-fs | bookworm-security | 2.1.3-0+deb12u2 | fixed |
| Ubuntu | node-tar-fs | noble | 2.1.1-6ubuntu0.24.04.1~esm1 | fixed |
| Ubuntu | node-tar-fs | pro | 2.1.1-6 | vulnerable |
| Ubuntu | node-tar-fs | pro | 2.1.1-6ubuntu0.24.04.1~esm1 | fixed |
| Ubuntu | node-tar-fs | 25.10 | 2.1.1-6 | vulnerable |
| Ubuntu | node-tar-fs | 25.10 | 3.0.8+~cs2.0.4-1 | vulnerable |
| Ubuntu | node-tar-fs | 25.10 | 3.0.9+~cs2.0.4-1 | vulnerable |
| Ubuntu | node-tar-fs | 25.10 | 3.0.9+~cs2.0.4-1+deb13u1build0.25.10.1 | fixed |
| Ubuntu | node-tar-fs | pro | 2.1.1-6 | vulnerable |
| Ubuntu | node-tar-fs | pro | 2.1.1-6ubuntu0.24.04.1~esm1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | node-tar-fs | source | sid | 3.0.8+~cs2.0.4-1 | not yet assigned | Not reported | [1101501] |
| Debian | node-tar-fs | source | forky | 3.0.8+~cs2.0.4-1 | not yet assigned | Not reported | [1101501] |
| Debian | node-tar-fs | source | trixie | 3.0.8+~cs2.0.4-1 | not yet assigned | Not reported | [1101501] |
| Debian | node-tar-fs | source | bookworm | 2.1.3-0+deb12u1 | not yet assigned | Not reported | [1101501] |
| Ubuntu | node-tar-fs | deb | noble | 2.1.1-6ubuntu0.24.04.1~esm1 | Not reported | Not reported | Not reported |
| Ubuntu | node-tar-fs | deb | pro | 2.1.1-6ubuntu0.24.04.1~esm1 | Not reported | USN-8367-1 | Not reported |
| Ubuntu | node-tar-fs | deb | 25.10 | 3.0.9+~cs2.0.4-1+deb13u1build0.25.10.1 | Not reported | USN-8367-1 | Not reported |
| Ubuntu | node-tar-fs | deb | pro | 2.1.1-6ubuntu0.24.04.1~esm1 | Not reported | UBUNTU-CVE-2024-12905 | Not reported |
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
[Debian 12 (Bookworm)]
- [node-tar-fs]Unknown
Details (4)
2.1.3-0+deb12u2· all · bookwormFixed · Fixed:
2.1.3-0+deb12u1usn · node-tar-fs · debian · bookworm; usn · node-tar-fs · debian · 12
2.1.3-0+deb12u2· all · bookwormFixed · Fixed:
2.1.3-0+deb12u1usn · node-tar-fs · debian · bookworm; usn · node-tar-fs · debian · 12
2.1.3-0+deb12u2· all · bookworm-securityFixed · Fixed:
2.1.3-0+deb12u1usn · node-tar-fs · debian · bookworm; usn · node-tar-fs · debian · 12
2.1.3-0+deb12u2· all · bookworm-securityFixed · Fixed:
2.1.3-0+deb12u1usn · node-tar-fs · debian · bookworm; usn · node-tar-fs · debian · 12
[Debian 13 (Trixie)]
- [node-tar-fs]Unknown
Details (4)
3.0.9+~cs2.0.4-1+deb13u1· all · trixieFixed · Fixed:
3.0.8+~cs2.0.4-1usn · node-tar-fs · debian · 13
3.0.9+~cs2.0.4-1+deb13u1· all · trixieFixed · Fixed:
3.0.8+~cs2.0.4-1usn · node-tar-fs · debian · 13
3.0.9+~cs2.0.4-1+deb13u1· all · trixie-securityFixed · Fixed:
3.0.8+~cs2.0.4-1usn · node-tar-fs · debian · 13
3.0.9+~cs2.0.4-1+deb13u1· all · trixie-securityFixed · Fixed:
3.0.8+~cs2.0.4-1usn · node-tar-fs · debian · 13
Observed:
References
- [https://osv.dev/vulnerability/DEBIAN-CVE-2024-12905]
- [https://osv.dev/vulnerability/DLA-4214-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2024-12905]
- [https://osv.dev/vulnerability/USN-8367-1]
- [https://security-tracker.debian.org/tracker/CVE-2024-12905]
- [https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12905.json]
- [https://ubuntu.com/security/notices/USN-8367-1]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [Ubuntu Security Notices (USN)]