Path traversal in tar-fs - CVE-2025-59343

Vulnerability identifier: #VU117332

CSH Severity: High

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-59343

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to symlink validation bypass if the destination directory is predictable with a specific tarball. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.

tar-fs
Debian Linux
Ubuntu
Fedora
Verify Identity Access Digital Credentials
QRadar Investigation Assistant
Astronomer with IBM
Maximo Application Suite - Monitor Component
Business Automation Insights
Langflow Desktop
MongoDB Enterprise Advanced with IBM
IBM Concert Software
IBM Observability with Instana
Cryostat
Confluence Data Center
IBM Cloud Pak for Business Automation
Ansible Automation Platform
Red Hat OpenShift Dev Spaces
App Connect Enterprise Certified Container
Confluence Server
IBM API Connect
IBM App Connect Enterprise
python3.11-galaxy-importer (Red Hat package)
aap-metrics-utility (Red Hat package)
automation-eda-controller (Red Hat package)
receptor (Red Hat package)
yarnpkg
node-tar-fs (Ubuntu package)
node-tar-fs (Debian package)
automation-gateway-proxy (Red Hat package)
ansible-automation-platform-installer (Red Hat package)
automation-gateway (Red Hat package)
python3.11-django-ansible-base (Red Hat package)
automation-platform-ui (Red Hat package)
ansible-builder (Red Hat package)
python3.11-daemon (Red Hat package)
python3.11-django (Red Hat package)
automation-controller (Red Hat package)
python3.11-galaxy-ng (Red Hat package)
automation-hub (Red Hat package)
ansible-navigator (Red Hat package)
IBM QRadar Data Synchronization App

Install updates from vendor's website.

tar-fs - addressed in versions 1.16.6, 2.1.4, 3.1.1
QRadar Investigation Assistant - update to 1.2.0
Astronomer with IBM - update to 1.1.0
IBM Concert Software - update to 2.2.0
IBM Observability with Instana - update to 1.0.307
Cryostat - update to 4.0.3
Confluence Server - addressed in versions 8.5.10, 9.2.5, 9.3.1, 9.5.1
Confluence Data Center - addressed in versions 8.5.10, 9.2.5, 9.3.1, 9.5.1
Maximo Application Suite - Monitor Component - addressed in versions 8.10.25, 8.11.23, 9.0.15, 9.1.5
IBM API Connect - update to 10.0.8.5
IBM App Connect Enterprise - addressed in versions 12.0.12.19, 13.0.5.0
Business Automation Insights - addressed in versions 24.0.0.0.5, 24.0.1.0.5, 25.0.0.0.2
IBM Cloud Pak for Business Automation - addressed in versions 24.0.1-IF006, 25.0.0-IF003
python3.11-galaxy-importer (Red Hat package) - addressed in versions 0.4.34-1.el8ap, 0.4.34-1.el9ap
aap-metrics-utility (Red Hat package) - update to 0.6.1-3.el9ap
automation-eda-controller (Red Hat package) - update to 1.2.1-1.el9ap
receptor (Red Hat package) - addressed in versions 1.6.0-2.1.el8ap, 1.6.0-2.1.el9ap
Langflow Desktop - update to 1.8.4
yarnpkg - addressed in versions 1.22.22-12.fc41, 1.22.22-12.fc42, 1.22.22-12.fc43
node-tar-fs (Ubuntu package) - addressed in versions 2.1.1-6ubuntu0.22.04.1~esm1, 2.1.1-6ubuntu0.24.04.1~esm1, 3.0.9+~cs2.0.4-1+deb13u1build0.25.10.1
node-tar-fs (Debian package) - addressed in versions 2.1.3-0+deb12u2, 3.0.9+~cs2.0.4-1+deb13u1
Ansible Automation Platform - addressed in versions 2.5, 2.6
automation-gateway-proxy (Red Hat package) - addressed in versions 2.5.10-3.el8ap, 2.6.6-4.el9ap
ansible-automation-platform-installer (Red Hat package) - addressed in versions 2.5-19.el8ap, 2.5-19.el9ap, 2.6-2.el9ap
automation-gateway (Red Hat package) - addressed in versions 2.5.20251022-1.el8ap, 2.5.20251022-1.el9ap, 2.6.20251022-1.el9ap
python3.11-django-ansible-base (Red Hat package) - addressed in versions 2.5.20251022-1.el8ap, 2.5.20251022-1.el9ap, 2.6.20251023-1.el9ap
automation-platform-ui (Red Hat package) - update to 2.6.2-1.el9ap
ansible-builder (Red Hat package) - update to 3.1.0-2.el9ap
python3.11-daemon (Red Hat package) - update to 3.1.2-1.el9ap
IBM QRadar Data Synchronization App - update to 3.3.0
Red Hat OpenShift Dev Spaces - update to 3.24.0
python3.11-django (Red Hat package) - addressed in versions 4.2.25-1.el8ap, 4.2.25-1.el9ap
automation-controller (Red Hat package) - addressed in versions 4.6.21-1.el8ap, 4.6.21-1.el9ap, 4.7.4-1.el9ap
python3.11-galaxy-ng (Red Hat package) - addressed in versions 4.10.9-1.el8ap, 4.10.9-1.el9ap, 4.11.2-1.el9ap
automation-hub (Red Hat package) - addressed in versions 4.10.9-1.el8ap, 4.10.9-1.el9ap, 4.11.2-1.el9ap
MongoDB Enterprise Advanced with IBM - update to 7.0.19
App Connect Enterprise Certified Container - update to 12.0.17
ansible-navigator (Red Hat package) - update to 25.8.0-2.el9ap

• https://github.com/mafintosh/tar-fs/commit/0bd54cdf06da2b7b5b95cd4b062c9f4e0a8c4e09
• https://github.com/mafintosh/tar-fs/security/advisories/GHSA-vj76-c3g6-qr5v

• Path traversal in tar-fs
• Debian update for node-tar-fs
• Fedora 43 update for yarnpkg
• Fedora 41 update for yarnpkg
• Fedora 42 update for yarnpkg
• IBM App Connect Enterprise update for tar-fs
• Multiple vulnerabilities in IBM QRadar Investigation Assistant
• Multiple vulnerabilities in Ansible Automation Platform 2.5 packages
• Multiple vulnerabilities in Red Hat build of Cryostat 4.0
• Multiple vulnerabilities in Ansible Automation Platform 2.6 packages
• IBM App Connect Enterprise Certified Container operands update for tar-stream
• Multiple vulnerabilities in Red Hat OpenShift Dev Spaces
• Multiple vulnerabilities in IBM Business Automation Insights
• Multiple vulnerabilities in IBM API Connect
• IBM Maximo Application Suite - Monitor Component update for tar-fs
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Astronomer with IBM update for tar-fs
• Multiple vulnerabilities in IBM Concert Software
• Confluence Data Center and Server update for tar-fs
• Multiple vulnerabilities in IBM Observability with Instana
• MongoDB Enterprise Advanced with IBM update for tar-fs
• Multiple vulnerabilities in IBM QRadar Data Synchronization App
• Multiple vulnerabilities in IBM Verify Identity Access Digital Credentials
• IBM Langflow Desktop update for tar-fs
• Ubuntu update for node-tar-fs