Main Vulnerability Database Exploits ID:12340 - Exploit for Path traversal in tar - CVE-2026-24842

ID:12340 - Exploit for Path traversal in tar - CVE-2026-24842

Published: January 28, 2026

Vulnerability identifier: #VU122099

Vulnerability risk: Medium

CVE-ID: CVE-2026-24842

CWE-ID: CWE-22

Exploitation vector: Remote access

Vulnerable software:
tar

Link to public exploit:

https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v/#poc

Vulnerability description

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in lib/unpack.js. A remote attacker can send a specially crafted HTTP request and read or overwrite arbitrary files on the system.

Remediation

Install updates from vendor's website.