CVE-2024-12905: tar-fs Path Traversal Vulnerability

CVE-2024-12905 Overview

CVE-2024-12905 affects the tar-fs Node.js package, a widely used module for streaming files into and out of tar archives. The vulnerability combines improper link resolution before file access (link following) and path traversal [CWE-22]. When tar-fs extracts a maliciously crafted tar archive, attackers can write or overwrite files outside the intended extraction directory. The flaw resides in index.js and impacts versions prior to 1.16.4, 2.1.2, and 3.0.8.

Critical Impact

A network attacker who supplies a crafted tar archive can write arbitrary files outside the target directory, leading to integrity compromise of the host filesystem and potential code execution through overwriting trusted files.

Affected Products

• tar-fs versions 0.0.0 through 1.16.3
• tar-fs versions 2.0.0 through 2.1.1
• tar-fs versions 3.0.0 through 3.0.7

Discovery Timeline

• 2025-03-27 - CVE-2024-12905 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-12905

Vulnerability Analysis

The tar-fs package extracts tar archives by iterating over archive entries and writing each entry to a target directory specified by the caller. The extraction routine in index.js failed to canonicalize the working directory and did not sufficiently validate symbolic link targets contained in archive entries.

An attacker who controls the archive content can include entries whose names contain .. sequences or whose link targets point outside the extraction root. During extraction, the library follows those links or resolves the relative paths against an unresolved base, causing file writes to escape the intended sandbox. This places the issue in the path traversal and link following class of vulnerabilities tracked under [CWE-22].

The exploit prediction score (EPSS) places this CVE in roughly the 74th percentile, indicating meaningful real-world exploitation likelihood. A working proof of concept is referenced in public exploit databases.

Root Cause

The extraction function accepted a caller-supplied cwd argument without resolving it to an absolute, canonical path before joining it with entry names from the archive. Combined with insufficient validation of symlink entries, this allowed crafted entries to resolve to filesystem locations outside cwd. See the Seal Security analysis for a detailed walkthrough.

Attack Vector

The attack vector is network-reachable in any context where tar-fs extracts archives originating from untrusted sources, including package installers, container build tooling, CI/CD artifact handlers, and file upload pipelines. The attacker supplies a tar archive containing either traversal sequences in entry names or symlink entries pointing to sensitive paths such as ~/.ssh/authorized_keys or system binaries.

// Patch from index.js - resolve cwd before extraction
// Source: https://github.com/mafintosh/tar-fs/commit/a1dd7e7c7f4b4a8bd2ab60f513baca573b44e2ed

   if (!cwd) cwd = '.'
   if (!opts) opts = {}
 
+  cwd = path.resolve(cwd)
+
   const xfs = opts.fs || fs
   const ignore = opts.ignore || opts.filter || noop
   const mapStream = opts.mapStream || echo

The patch resolves cwd to an absolute path so subsequent containment checks operate on a stable base. The fix also refactors symlink handling to throw when an entry targets a path outside the extraction root.

Detection Methods for CVE-2024-12905

Indicators of Compromise

• Unexpected files written outside known extraction directories shortly after a Node.js process invokes tar-fs.
• Modification of sensitive files such as ~/.ssh/authorized_keys, ~/.npmrc, or systemd unit files by Node.js processes.
• Tar archives containing entries with ../ sequences in their names or symlink entries whose linkname points to absolute paths.

Detection Strategies

• Inventory Node.js applications and container images for vulnerable versions of tar-fs using software composition analysis (SCA) against package-lock.json and yarn.lock.
• Inspect tar archives received from untrusted sources with a parser that flags entries containing .. segments or symlinks pointing outside the archive root.
• Correlate process telemetry to identify node processes writing to filesystem paths outside the working directory of the extraction call.

Monitoring Recommendations

• Enable filesystem auditing on sensitive directories such as /etc, user home directories, and CI workspace roots.
• Log and review tar extraction operations in build pipelines, capturing source archive hashes and extraction targets.
• Alert on writes to authentication-related files by interpreter processes that do not normally touch them.

How to Mitigate CVE-2024-12905

Immediate Actions Required

• Upgrade tar-fs to 1.16.4, 2.1.2, or 3.0.8 or later depending on the major version in use.
• Audit transitive dependencies, because tar-fs is frequently pulled in indirectly by container tooling and package managers.
• Treat any tar archive from an untrusted source as hostile until extraction occurs inside a sandboxed directory on a patched version.

Patch Information

The upstream fix is committed in mafintosh/tar-fs commit a1dd7e7 and shipped in versions 1.16.4, 2.1.2, and 3.0.8. Debian users should apply updates announced in the Debian LTS advisory.

Workarounds

• Validate every archive entry name and linkname against an allowlist before invoking extraction, rejecting any entry containing .. or absolute paths.
• Extract archives inside an ephemeral chroot or container with no write access to host paths.
• Disable symlink creation during extraction by passing a custom fs implementation that throws on symlink calls.

# Pin a fixed version across npm projects
npm install tar-fs@^3.0.8

# Verify the resolved version in a lockfile
npm ls tar-fs

# For Debian-based systems, apply the LTS update
sudo apt update && sudo apt install --only-upgrade node-tar-fs