4.1

CVE-2025-45582: gnu tar Path Traversal: '../filedir'

CVSS: 4.1v3.1MediumModified
AliasesSUSE-SU-2026:1177-1SUSE-SU-2026:20955-1SUSE-SU-2026:20959-1
Published 11-07-2025Last modified 02-11-2025
Open JSON

Vulnerability summary

CVE-2025-45582 is a medium (CVSS 4.1) Path Traversal: '../filedir' vulnerability in gnu tar. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 40.7% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
26/100
0100
Medium · default modelHow is this calculated?
CVSS score
4.1/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.49%
0%100%
Low · +0.04 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 5 · Related 3
MGASA-2026-0401OPENSUSE-SU-2026:21070-1RHSA-2026:70390SUSE-SU-2026:22289-1SUSE-SU-2026:22377-1

Timeline

  1. 11-07-2025
    PublishedVulnerability first disclosed.
  2. 02-11-2025
    Last modifiedVulnerability information updated.

Description

GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of "Member name contains '..'" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain "x -> ../../../../../home/victim/.ssh" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in which "tar xf" is run more than once (e.g., when installing a package can automatically install two dependencies that are set up as untrusted tarballs instead of official packages). NOTE: the official GNU Tar manual has an otherwise-empty directory for each "tar xf" in its Security Rules of Thumb; however, third-party advice leads users to run "tar xf" more than once into the same directory.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.49%

Chance of exploitation in the next 30 days

Percentile

41%

Versus all other CVEs

30-day change

+0.04 pp

From 0.45% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.49%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • githubUnverified

    Vulndb

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Suse22 products
  • tar&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 1.34-150000.3.37.1
  • tar&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 1.34-150000.3.37.1
  • tar&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS< 1.34-150000.3.37.1
  • tar&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS< 1.34-150000.3.37.1
  • tar&distro=SUSE Linux Enterprise Micro 5.2< 1.34-150000.3.37.1
Opensuse3 products
  • tar&distro=openSUSE Leap 15.6< 1.34-150000.3.37.1
  • tar&distro=openSUSE Leap 16.0< 1.35-160000.3.1
  • tar&distro=openSUSE Tumbleweed< 1.35-7.1
Redhat3 products
  • tar< 2:1.35-9.el10_1 | < 2:1.34-9.el9_7 | < 2:1.35-7.el10_0.2 | < 2:1.34-6.el9_4.3 | < 2:1.34-7.el9_6.2
  • tar-debuginfo< 2:1.35-9.el10_1 | < 2:1.34-9.el9_7 | < 2:1.34-6.el9_4.3
  • tar-debugsource< 2:1.35-9.el10_1 | < 2:1.34-9.el9_7 | < 2:1.34-6.el9_4.3
Gnu1 product
  • tar≤ 1.35 | < 1.35
Ubuntu1 product
  • tarAll versions (No fix recorded) | < 1.34+dfsg-1ubuntu0.1.22.04.4 | < 1.35+dfsg-3ubuntu0.2 | < 1.35+dfsg-4ubuntu0.2

5 vendors · 30 products

References

34 links
Show all 34 references