CVE-2025-48387 Overview
CVE-2025-48387 is a path traversal vulnerability in tar-fs, a widely used Node.js library that provides filesystem bindings for tar-stream. The flaw allows a crafted tarball to write files outside the target extraction directory during archive extraction. The vulnerability affects versions prior to 3.0.9, 2.1.3, and 1.16.5. The issue is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. Maintainers patched the issue in versions 3.0.9, 2.1.3, and 1.16.5. Debian also issued an LTS advisory addressing the flaw across distribution packages.
Critical Impact
Attackers can deliver a malicious tarball that, when extracted by an application using a vulnerable tar-fs version, writes arbitrary files outside the intended extraction directory, enabling integrity compromise across the host filesystem.
Affected Products
- tar-fs versions prior to 1.16.5 (1.x branch)
- tar-fs versions prior to 2.1.3 (2.x branch)
- tar-fs versions prior to 3.0.9 (3.x branch)
Discovery Timeline
- 2025-06-02 - CVE-2025-48387 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-48387
Vulnerability Analysis
The vulnerability resides in the archive extraction logic of tar-fs. The library iterates over entries inside a tar archive and writes them to a destination directory supplied by the caller. The extraction routine does not adequately validate or normalize entry paths for non-file/non-directory entry types, allowing crafted entries to escape the destination directory. An attacker who can deliver or influence a tarball processed by an application using tar-fs can write files at attacker-controlled locations on the host filesystem. This affects the integrity of the system, as indicated by the CVSS vector's high integrity impact with no confidentiality or availability impact.
Root Cause
The root cause is improper limitation of a pathname to a restricted directory during tar entry processing. Specific entry types, such as symlinks, hardlinks, or other non-regular entries, were not constrained to the extraction root. As a result, the resolved write target could traverse parent directories and land outside the intended sandbox. The maintainer fix in commit 647447b572bc135c41035e82ca7b894f02b17f0f tightens path handling and entry filtering during extraction.
Attack Vector
The vulnerability is exploitable over the network when an application accepts tar archives from untrusted sources and extracts them with tar-fs. No authentication or user interaction is required if the application processes attacker-supplied archives automatically. Common scenarios include container image handling, package managers, build pipelines, CI/CD systems, and any service that unpacks user-uploaded tarballs. The vulnerability does not require local access. Successful extraction of a crafted archive results in file writes to arbitrary filesystem locations, which can lead to configuration tampering, dropped scripts in startup paths, or replacement of trusted binaries.
No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-8cj5-5rvv-wf4v and the Google Security Research advisory GHSA-xrg4-qp5w-2c3w for technical details.
Detection Methods for CVE-2025-48387
Indicators of Compromise
- Files written outside the expected extraction directory during or shortly after archive processing by Node.js services.
- Unexpected symlinks or hardlinks created in application working directories after a tar extraction operation.
- New or modified files in sensitive paths such as ~/.ssh/, /etc/, cron directories, or service unit directories correlating with archive uploads.
Detection Strategies
- Inventory Node.js applications and inspect package-lock.json and yarn.lock for tar-fs versions below 1.16.5, 2.1.3, or 3.0.9.
- Use software composition analysis (SCA) tooling to flag vulnerable tar-fs versions in direct and transitive dependencies.
- Audit application logs around extraction operations for path normalization warnings or write failures referencing parent-relative paths.
Monitoring Recommendations
- Monitor filesystem write events from Node.js processes targeting paths outside designated upload or extraction directories.
- Alert on creation of symbolic links by archive-processing services, particularly when targets reference paths above the extraction root.
- Correlate ingress of .tar, .tar.gz, or .tgz uploads with subsequent file writes outside the application sandbox.
How to Mitigate CVE-2025-48387
Immediate Actions Required
- Upgrade tar-fs to 3.0.9, 2.1.3, or 1.16.5 depending on the major version in use.
- Rebuild and redeploy container images and serverless artifacts that bundle the vulnerable library.
- Apply the Debian LTS update referenced in the Debian LTS Announcement for affected distribution packages.
- Review all services that accept user-supplied tar archives and confirm they run with least privilege.
Patch Information
The maintainer addressed the issue in commit 647447b572bc135c41035e82ca7b894f02b17f0f and released fixed versions 3.0.9, 2.1.3, and 1.16.5. Reference the GitHub commit and the tar-fs Security Advisory for change details.
Workarounds
- Use the ignore option in tar-fs to skip entries that are not regular files or directories during extraction.
- Extract archives inside isolated containers, chroots, or unprivileged users to limit the blast radius of out-of-bounds writes.
- Validate tar entries before extraction by rejecting entries whose resolved path is not within the intended destination directory.
# Upgrade tar-fs to a patched version
npm install tar-fs@^3.0.9
# or for the 2.x branch
npm install tar-fs@^2.1.3
# or for the 1.x branch
npm install tar-fs@^1.16.5
# Verify installed version
npm ls tar-fs
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
