CVE-2025-48387: mafintosh tar-fs Path Traversal
CVSS: 8.7v4.0HighDeferred
AliasesUBUNTU-CVE-2025-48387DEBIAN-CVE-2025-48387CGA-4g9p-x3h3-qmvpCGA-4wpg-jpjr-w49vCGA-6288-564r-63f3CGA-665m-w3hw-pg62CGA-79vm-p565-xhm5CGA-7xq3-w7cw-xvqqCGA-9h52-w28c-ffj4CGA-cf8h-p4c7-9q69CGA-hxm3-45c8-22m2CGA-jj55-79h6-j79qCGA-p8w9-pg2v-r789CGA-r372-mgxp-pxprCGA-rvxp-4f22-c74jGHSA-8cj5-5rvv-wf4vCGA-2j4x-9wq6-h3r2CGA-2p83-gvp6-8hgmCGA-3rc6-42g3-vmcwCGA-45vr-x754-w48fCGA-479w-hmf5-7gg2CGA-4g5m-xjg8-wrvrCGA-4jc5-5h59-r77vCGA-54gq-xxc6-rw7xCGA-5829-xqh8-r452CGA-645w-fj54-6rjwCGA-64cf-pq7f-hmh8CGA-6699-9g5c-x7jpCGA-75q4-v4xq-cfrgCGA-76fj-qp97-94w2CGA-7cx5-rwwh-66pxCGA-87m4-2cqg-9gq3CGA-8g2j-fqcj-v9wmCGA-8hxg-2pw6-9262CGA-9fww-mfvg-gv3wCGA-c2vx-7vmx-7fmfCGA-c6xm-46vm-pjvcCGA-cvp7-c7jx-7q8pCGA-f88p-7hcf-jfj7CGA-fv6m-xp44-jhvxCGA-g38p-22mq-2g32CGA-g4vr-prwq-m2p3CGA-hg57-59j8-j2r6CGA-hgqm-8mq8-cwj4CGA-hv4w-r5vh-p5g7CGA-j7qg-rpx6-cp9mCGA-j8jh-f9vj-49hhCGA-jcwx-65vf-j296CGA-jqjm-86jx-rx2hCGA-jvcg-3cph-fr98CGA-jvrp-hp9r-8m85CGA-mgvq-w829-cxmgCGA-p6wv-3gcf-r3fvCGA-pm33-9wrp-5428CGA-pm5j-8x3r-7563CGA-qf67-pw9x-rq26CGA-qhr2-v97x-gx47CGA-r236-656g-7cxvCGA-r2wc-hfw3-h5pgCGA-rprp-4p49-cjxfCGA-v25h-cwh3-6r8jCGA-vg75-vgcw-6h67CGA-vpjg-8735-jh8fCGA-vqq7-3wrx-mw7mCGA-w85v-jxrp-rc39CGA-wmpg-3gxv-6wwqCGA-wq9p-wwcw-r3hwCGA-wvx8-c27x-2fjqCGA-x2pr-r998-83pgCGA-x992-8cvm-gh8qCGA-x9ch-5x9p-c687CGA-xgf7-v3mp-rw7j
Published 02-06-2025Last modified 03-11-2025
Vulnerability summary
CVE-2025-48387 is a high (CVSS 8.7) Path Traversal vulnerability in mafintosh tar-fs. EPSS estimates a 0.58% chance of exploitation in the next 30 days, higher than 46.4% of scored vulnerabilities.
CVSS score
8.7/10
010
High · v4.0 (CVE.org)EPSS score
0.58%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 3 · Related 5Timeline
- 02-06-2025PublishedVulnerability first disclosed.
- 03-11-2025Last modifiedVulnerability information updated.
Description
tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified dir with a specific tarball. This has been patched in versions 3.0.9, 2.1.3, and 1.16.5. As a workaround, use the ignore option to ignore non files/directories.
CVSS metrics
7 scores · 7 sources · 1 versionHigh 8.7Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:NSourcesAll 7 agree
- OSV · UbuntuEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- OSV · DebianEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · WolfiEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- OSV · NpmEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- NVDNIST8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.58%
Chance of exploitation in the next 30 days
Percentile
46%
Versus all other CVEs
30-day change
0.00 pp
From 0.58% on 19-09-2026
19-09-202619-10-2026
EPSS score0.58%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard34 products
- code-server< 4.105.1-r1
- gitlab-rails-ce-18.1All versions (No fix recorded)
- gitlab-rails-ce-18.10All versions (No fix recorded)
- gitlab-rails-ce-18.11All versions (No fix recorded)
- gitlab-rails-ce-18.5All versions (No fix recorded)
Wolfi8 products
- code-server< 4.105.1-r1
- jitsucom-jitsu< 2.10.0-r0
- jitsucom-jitsu-console< 2.10.0-r0
- jitsucom-jitsu-rotor< 2.10.0-r0
- sqlpad< 7.5.3-r2
Debian1 product
- node-tar-fs< 2.1.3-0+deb12u1 | < 3.0.9+~cs2.0.4-1
Mafintosh1 product
- tar-fs< 1.16.5 | ≥ 2.0.0, < 2.1.3 | ≥ 3.0.0, < 3.0.9
Npm1 product
- tar-fs< 1.16.5 | ≥ 2.0.0, < 2.1.3 | ≥ 3.0.0, < 3.0.9
Ubuntu1 product
- node-tar-fs< 2.1.1-6ubuntu0.22.04.1~esm1 | < 2.1.1-6ubuntu0.24.04.1~esm1
6 vendors · 46 products
References
11 links- github.com/mafintosh/tar-fs/security/advisories/GHSA-8cj5-5rvv-wf4vX Refsource CONFIRMREPORTAdvisoryWEB
- github.com/google/security-research/security/advisories/GHSA-xrg4-qp5w-2c3wX Refsource MISCAdvisoryWEB
- github.com/mafintosh/tar-fs/commit/647447b572bc135c41035e82ca7b894f02b17f0fX Refsource MISCREPORTFIXWEB
Show all 11 references
- github.com/mafintosh/tar-fsPACKAGE