CVE-2024-12905

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-12905
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-12905.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-12905
Aliases
Downstream
Related
Published
2025-03-27T16:25:34.410Z
Modified
2026-05-18T05:56:55.231669395Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

An Improper Link Resolution Before File Access ("Link Following") and Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal"). This vulnerability occurs when extracting a maliciously crafted tar file, which can result in unauthorized file writes or overwrites outside the intended extraction directory. The issue is associated with index.js in the tar-fs package.

This issue affects tar-fs: from 0.0.0 before 1.16.4, from 2.0.0 before 2.1.2, from 3.0.0 before 3.0.8.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/12xxx/CVE-2024-12905.json",
    "cwe_ids": [
        "CWE-22",
        "CWE-59"
    ],
    "cna_assigner": "seal"
}
References

Affected packages

Git / github.com/mafintosh/tar-fs

Affected ranges

Type
GIT
Repo
https://github.com/mafintosh/tar-fs
Events
Introduced
6d66143dc5e40480dd6135a4453f6da26a5602e0
Fixed
e4a7a401e80267247b8e9e39d8e5ba82c4fe2f7b

Affected versions

v3.*
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.0.5
v3.0.6
v3.0.7

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-12905.json"