Path traversal in Tar - CVE-2025-45582

Vulnerability identifier: #VU120256

CSH Severity: Low

CVSS v4: 1 [CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:L]

CVE-ID: CVE-2025-45582

CWE-ID: CWE-22

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences. A local user can trick the victim into opening a specially crafted HTTP request and read arbitrary files on the system.

Tar
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Micro for Rancher
SUSE Linux Enterprise Micro
SUSE Linux Micro
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Basesystem Module
openSUSE Leap
openEuler
Ubuntu
Anolis OS
Fedora
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
AppDynamics NodeJS Agent
IBM MQ Operator
Red Hat Update Infrastructure (RHUI)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
tar (Ubuntu package)
tar
tar-help
tar-debugsource
tar-debuginfo
tar (Red Hat package)
tar-lang
tar-tests
tar-tests-debuginfo
tar-rmt-debuginfo
tar-rmt
tar-backup-scripts
tar-doc
OpenShift Virtualization
IBM supplied MQ Advanced container images

Install updates from vendor's website.

IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.3
AppDynamics NodeJS Agent - update to 25.12.1
tar (Ubuntu package) - addressed in versions 1.34+dfsg-1ubuntu0.1.22.04.4, 1.35+dfsg-3ubuntu0.2, 1.35+dfsg-4ubuntu0.2
tar - addressed in versions 1.34-6, 1.35-3
tar-help - addressed in versions 1.34-6, 1.35-3
tar-debugsource - addressed in versions 1.34-6, 1.35-3
tar-debuginfo - addressed in versions 1.34-6, 1.35-3
tar (Red Hat package) - addressed in versions 1.34-6.el9_4.3, 1.34-7.el9_6.2, 1.35-7.el10_0.2, 1.35-9.el10_1
tar-debugsource - addressed in versions 1.34-15.27.1, 1.34-150000.3.37.1, 1.35-3.1
tar-debuginfo - addressed in versions 1.34-15.27.1, 1.34-150000.3.37.1, 1.35-3.1
tar - addressed in versions 1.34-15.27.1, 1.34-150000.3.37.1, 1.35-3.1
tar-lang - addressed in versions 1.34-15.27.1, 1.34-150000.3.37.1
tar-tests - update to 1.34-150000.3.37.1
tar-tests-debuginfo - update to 1.34-150000.3.37.1
tar-rmt-debuginfo - update to 1.34-150000.3.37.1
tar-rmt - update to 1.34-150000.3.37.1
tar-backup-scripts - update to 1.34-150000.3.37.1
tar-doc - update to 1.34-150000.3.37.1
tar - update to 1.35-2
tar-doc - update to 1.35-2
tar - update to 1.35-8.fc44
IBM MQ Operator - update to 3.9.0
OpenShift Virtualization - update to 4.19.17
Red Hat Update Infrastructure (RHUI) - update to 5.0.0
IBM supplied MQ Advanced container images - addressed in versions 9.4.0.17-r2, 9.4.5.0-r1

• https://github.com/i900008/vulndb/blob/main/Gnu_tar_vuln.md
• https://lists.gnu.org/archive/html/bug-tar/2025-08/msg00012.html
• https://www.gnu.org/software/tar/
• https://www.gnu.org/software/tar/manual/html_node/Integrity.html
• https://www.gnu.org/software/tar/manual/html_node/Security-rules-of-thumb.html
• http://www.openwall.com/lists/oss-security/2025/11/01/6

• Path traversal in GNU Tar
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge
• Red Hat Enterprise Linux 10 update for tar
• Red Hat Enterprise Linux 10 update for tar
• Red Hat Enterprise Linux 9 update for tar
• Red Hat Enterprise Linux 9 update for tar
• openEuler 22.03 LTS SP3 update for tar
• openEuler 24.03 LTS SP3 update for tar
• openEuler 24.03 LTS SP2 update for tar
• openEuler 24.03 LTS SP1 update for tar
• openEuler 24.03 LTS update for tar
• openEuler 22.03 LTS SP4 update for tar
• Multiple vulnerabilities in Red Hat Update Infrastructure (RHUI) 5 container images
• Multiple vulnerabilities in OpenShift Virtualization 4.19
• Fedora 44 update for tar
• Multiple vulnerabilities in IBM MQ Operator and Queue manager container images
• Anolis OS update for tar
• Splunk AppDynamics NodeJS Agent update for third-party components
• SUSE update for tar
• SUSE update for tar
• SUSE update for tar
• Ubuntu update for tar