Path traversal in tar-fs - CVE-2025-48387

Vulnerability identifier: #VU112157

CSH Severity: High

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-48387

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to an issue where an extract can write outside the specified dir with a specific tarball. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.

tar-fs
QRadar Investigation Assistant
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component
Maximo Application Suite - Monitor Component
Business Automation Insights
Verify Identity Access Digital Credentials
Astronomer with IBM
Fedora
Ubuntu
IBM Cloud Pak for Business Automation
Confluence Data Center
yarnpkg
node-tar-fs (Ubuntu package)
IBM QRadar Data Synchronization App
Confluence Server

Install updates from vendor's website.

tar-fs - addressed in versions 1.16.5, 2.1.3, 3.0.9
QRadar Investigation Assistant - update to 1.1.0
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component - update to 5.2.1
Maximo Application Suite - Monitor Component - addressed in versions 8.10.21, 8.11.19, 9.0.11
Business Automation Insights - addressed in versions 24.0.0.0.5, 24.0.1.0.5, 25.0.0.0.2
IBM Cloud Pak for Business Automation - addressed in versions 24.0.0-IF005, 24.0.1-IF004, 25.0.0
Astronomer with IBM - update to 1.1.0
yarnpkg - addressed in versions 1.22.22-8.el8, 1.22.22-8.el9, 1.22.22-8.el10_1, 1.22.22-8.fc41, 1.22.22-8.fc42
node-tar-fs (Ubuntu package) - addressed in versions 2.1.1-6ubuntu0.22.04.1~esm1, 2.1.1-6ubuntu0.24.04.1~esm1, 3.0.9+~cs2.0.4-1+deb13u1build0.25.10.1
IBM QRadar Data Synchronization App - update to 3.3.0
Confluence Server - addressed in versions 8.5.10, 9.2.5, 9.3.1, 9.5.1, 10.0.2, 10.1.0
Confluence Data Center - addressed in versions 8.5.10, 9.2.5, 9.3.1, 9.5.1, 10.0.2, 10.1.0

• https://github.com/mafintosh/tar-fs/commit/647447b572bc135c41035e82ca7b894f02b17f0f
• https://github.com/mafintosh/tar-fs/security/advisories/GHSA-8cj5-5rvv-wf4v

• Path traversal in tar-fs
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Fedora EPEL 9 update for yarnpkg
• Fedora 41 update for yarnpkg
• Fedora 42 update for yarnpkg
• Fedora EPEL 10.1 update for yarnpkg
• Fedora EPEL 8 update for yarnpkg
• Multiple vulnerabilities in IBM Verify Identity Access Digital Credentials
• Multiple vulnerabilities in IBM QRadar Investigation Assistant
• IBM Maximo Application Suite - Monitor Component update for tar-fs
• IBM watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component update for tar-stream
• Multiple vulnerabilities in IBM Business Automation Insights
• Astronomer with IBM update for tar-fs
• Confluence Data Center and Server update for tar-fs
• Multiple vulnerabilities in IBM QRadar Data Synchronization App
• Ubuntu update for node-tar-fs